[syslog-ng]logs getting stomped on
Balazs Scheidler
bazsi@balabit.hu
Thu, 30 Jan 2003 09:58:16 +0100
On Wed, Jan 29, 2003 at 11:25:08PM -0500, Brian Landers wrote:
> Sorry to keep harping on this guys, but this is a ^%$#@ mystery!
> Once again, my mail log restarted at around 10:30pm tonight. Lest
> you think I'm just whining and not making an effort to solve this
> one, here's what I've come up with:
Hm.. please try attaching truss to the syslog-ng process somewhat before
that time (e.g. 10:25pm) just to see whether it is syslog-ng that truncates
your file.
Then post an url to the truss dump and a list of open files by syslog-ng
(use /usr/proc/bin/pfiles to get a list of open files on a process)
--
Bazsi
PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1