[syslog-ng]File descriptor still opened after log rotation

[Balazs Scheidler]

On Tue, Jan 21, 2003 at 04:02:30PM +0100, Xavier de Labouret wrote:
> 
> Hello,
> 
> I have a strange behaviour with syslog-ng 1.4.16 and rotated files. It
> looks like syslog-ng keeps file descriptors opened, despite the time_reap
> parameter, in a file where very few logs are sent. This generates
> problems with log rotations.
> 
> Here is my syslog-ng.conf (extract). 
> 
> --------------8<----------------
> 
> options { long_hostnames(off); sync(0); owner("root"); group("adm"); perm(0644); time_reap(30); };
> 
> source src { unix-stream("/dev/log"); internal(); udp(); };
> filter f_heartbeat { facility(local7) and program(heartbeat/syslog-ng); };
> destination d_heartbeat { file("/usr2/log/heartbeat.log"); };
> 
> log { source(src); filter(f_heartbeat); destination(d_heartbeat); };
> 
> -------------->8----------------
> 
> Important points are: target file is /usr2/log/heartbeat.log, time_reap is set to 30.
> 
> 
> My "heartbeat" application is logging every 5 minutes in this file,
> with the appname "heartbeat/syslog-ng". *This is the only line logged to
> this destination*. So we have 5 minutes of inactivity between 2 logs.
> 
> I rotate heartbeat.log every 5 minutes too, 3 minutes after the call to
> the heartbeat application. I am using savelog for the rotation.

time_reap() is only used when a filename with macros in it is used. e.g.

destination d_heartbeat { file("/usr2/log/$YEAR-$MONTH-$DAY/heartbeat.log"); };

-- 
Bazsi
PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1