[syslog-ng] logline corruption

[Valdis.Kletnieks at vt.edu]

On Mon, 05 Dec 2005 15:07:56 EST, Erik Williamson said:

> being written to a local disk.  There are many destination files on
> the server, but it is possible that more than one logging server may
> be attempting to write to the same destination file at the same time.

More than one process writing to a file without benefit of locking is
looking for exactly the sort of corruption you're seeing (although for
local files, opening with O_APPEND may help, but not for NFS - the
Linux 'man 2 open' manpage says:

       O_APPEND
              The file is opened in append mode. Before each write(), the file
              offset is positioned at the end of the file, as if with lseek().
              O_APPEND may lead to corrupted files on NFS file systems if more
              than  one  process  appends  data  to  a  file at once.  This is
              because NFS does not support appending to a file, so the  client
              kernel  has  to  simulate it, which can't be done without a race
              condition.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.balabit.hu/pipermail/syslog-ng/attachments/20051206/80e00875/attachment.pgp