Sirs: Several months ago I submitted the following patch to syslog-ng, which makes the "file" source work even if the file is not present when syslog-ng starts up. (Consider the scenario where syslog-ng starts up before some other service which logs to a file, and that file has not yet been created yet.) This patch causes syslog-ng to treat the transition from "nonexistent" to "existent" the same as if the file were moved/renamed. We are using the patched version of syslog-ng in our project and find this modification helpful. It is a very non-intrusive change, and I cannot see any negative side-effects. I would like to know if there is any chance for this patch to be incorporated into the official distribution. Thanks for your consideration. Charles G Waldman High-Energy Physics University of Chicago cgw@hep.uchicago.edu Patch: (also available as http://repo.mwt2.org/viewvc/patches/syslog-ng-file-source.patch ) --- syslog-ng-2.0.4/src/affile.c 2007-04-19 14:37:16.000000000 -0500 +++ syslog-ng-2.0.4-cgw2/src/affile.c 2007-06-07 11:41:00.000000000 -0500 @@ -134,7 +134,7 @@ gint fd; msg_verbose("Follow-mode file source moved, tracking of the new file is started", - evt_tag_str("file", self->filename->str), + evt_tag_str("filename", self->filename->str), NULL); log_pipe_deinit(self->reader, NULL, NULL); @@ -170,14 +170,26 @@ { AFFileSourceDriver *self = (AFFileSourceDriver *) s; gint fd; + gboolean file_opened, open_deferred=FALSE; log_reader_options_init(&self->reader_options, cfg); - if (affile_sd_open_file(self, &fd)) + file_opened = affile_sd_open_file(self, &fd); + + if (!file_opened && self->reader_options.follow_freq > 0) + { + msg_info("Follow-mode file source not found, deferring open", + evt_tag_str("filename", self->filename->str), + NULL); + open_deferred = TRUE; + fd = -1; + } + + if (file_opened || open_deferred) { self->reader = log_reader_new(fd_read_new(fd, 0), LR_LOCAL | LR_NOMREAD, s, &self->reader_options); - if (persist) + if (persist && file_opened) { gchar *str; off_t cur_pos; --- syslog-ng-2.0.4/src/logreader.c 2007-04-20 15:11:07.000000000 -0500 +++ syslog-ng-2.0.4-cgw2/src/logreader.c 2007-06-07 11:26:12.000000000 -0500 @@ -100,29 +100,32 @@ struct stat st, followed_st; off_t pos; - pos = lseek(self->fd->fd, 0, SEEK_CUR); - if (pos == (off_t) -1) - { - msg_error("Error invoking seek on followed file", - evt_tag_errno("error", errno), - NULL); - return FALSE; - } - - if (fstat(self->fd->fd, &st) < 0) - { - msg_error("Error invoking fstat() on followed file", - evt_tag_errno("error", errno), - NULL); - return FALSE; - } + if (self->fd->fd >= 0) + { + pos = lseek(self->fd->fd, 0, SEEK_CUR); + if (pos == (off_t) -1) + { + msg_error("Error invoking seek on followed file", + evt_tag_errno("error", errno), + NULL); + return FALSE; + } + + if (fstat(self->fd->fd, &st) < 0) + { + msg_error("Error invoking fstat() on followed file", + evt_tag_errno("error", errno), + NULL); + return FALSE; + } - if (pos < st.st_size) - return TRUE; + if (pos < st.st_size) + return TRUE; + } if (self->reader->options->follow_filename && stat(self->reader->options->follow_filename, &followed_st) != -1) { - if (st.st_ino != followed_st.st_ino) + if (self->fd->fd < 0 || st.st_ino != followed_st.st_ino) { /* file was moved and we are at EOF, follow the new file */ log_pipe_notify(self->reader->control, &self->reader->super.super, NC_FILE_MOVED, self);