On Mon, 2010-07-05 at 17:51 +0300, Risto Vaarandi wrote:

hi all,

is file() driver intended for reading kernel messages only on Linux, or does it work for regular files also? I've tried to get the following simple configuration working, but without success:

source textfile { file("/home/risto/test.log" flags(no-parse) follow-freq(1)); }; destination testlog { file("/var/log/test.log"); }; log { source(textfile); destination(testlog); };

The source definition is identical to the example from the syslog-ng administrator guide (I've played with the options, but the result is the same).

When syslog-ng starts up, it produces the following error messages:

Follow-mode file source not found, deferring open; filename='/home/risto/test.log' The current log file has a mismatching size/inode information, restarting from the beginning; filename='/home/risto/test.log'

If the file is not there, it should try to open this file once every second (follow_freq() intervals).

If /home/risto/test.log does not exist, only the first message is produced. Is reading from regular files only supported by PE? (I am using the 3.0.7 open source version of syslog-ng.)

No, it should work with 3.0 OSE as well (even prior to that). However, I know about a bug in 3.0.7 which causes syslog-ng it incorrectly flush destination files. Do you perhaps use flush_lines(), flush_timeout() options? -- Bazsi