[syslog-ng]RE: HUP'ing syslog-ng causes data loss

[Balazs Scheidler]

On Tue, Dec 18, 2001 at 01:53:19PM -0600, UK wrote:
> 
> Follow-up question:
> 
> To rotate logs, should I be sending a HUP to syslog-ng or is there another
> way to accomplish this?

in 1.5.x there's a hackish way to make syslog-ng reopen its files, but
probably it will be discontinued, and a similar feature will be provided.

there's a remote_control destination driver, which has some limited ways
controlling syslog-ng, with the means of log messages.

so create a log path which sends messages to this driver (probably a
separate source should be created for this purpose). To reopen a file
without HUP signal, just send a message to this driver containing the full
path and filename of the file to be reopened.

so something like this should be used:

source s_ctrl { pipe("/var/run/syslog-ng-ctl"); };
destination d_ctrl { remote_control(); };
log { source(s_ctrl); destination(d_ctrl); };

and reopen a file this way:

echo /var/log/messages > /var/run/syslog-ng-ctl

(of course /var/run/syslog-ng-ctl should be created using mkfifo)

-- 
Bazsi
PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1