[syslog-ng] Patch for following logfiles

[Charles G Waldman]

Sirs:

    Several months ago I submitted the following patch to syslog-ng, which
makes the "file" source work even if the file is not present when syslog-ng
starts up.  (Consider the scenario where syslog-ng starts up before some
other service which logs to a file, and that file has not yet been created
yet.)   This patch causes syslog-ng to treat the transition from "nonexistent"
to "existent" the same as if the file were moved/renamed.

    We are using the patched version of syslog-ng in our project and find this
modification helpful.  It is a very non-intrusive change, and I cannot see any
negative side-effects.  I would like to know if there is any chance for this
patch to be incorporated into the official distribution.  Thanks for your
consideration.

                                    Charles G Waldman
                                    High-Energy Physics
                                    University of Chicago
                                    cgw at hep.uchicago.edu




Patch:  (also available as http://repo.mwt2.org/viewvc/patches/syslog-ng-file-source.patch )

--- syslog-ng-2.0.4/src/affile.c	2007-04-19 14:37:16.000000000 -0500
+++ syslog-ng-2.0.4-cgw2/src/affile.c	2007-06-07 11:41:00.000000000 -0500
@@ -134,7 +134,7 @@
          gint fd;

          msg_verbose("Follow-mode file source moved, tracking of the new file is started",
-                    evt_tag_str("file", self->filename->str),
+                    evt_tag_str("filename", self->filename->str),
                      NULL);

          log_pipe_deinit(self->reader, NULL, NULL);
@@ -170,14 +170,26 @@
  {
    AFFileSourceDriver *self = (AFFileSourceDriver *) s;
    gint fd;
+  gboolean file_opened, open_deferred=FALSE;

    log_reader_options_init(&self->reader_options, cfg);

-  if (affile_sd_open_file(self, &fd))
+  file_opened = affile_sd_open_file(self, &fd);
+
+  if (!file_opened && self->reader_options.follow_freq > 0)
+    {
+      msg_info("Follow-mode file source not found, deferring open",
+	       evt_tag_str("filename", self->filename->str),
+	       NULL);
+      open_deferred = TRUE;
+      fd = -1;
+    }
+
+  if (file_opened || open_deferred)
      {
        self->reader = log_reader_new(fd_read_new(fd, 0), LR_LOCAL | LR_NOMREAD, s, &self->reader_options);

-      if (persist)
+      if (persist && file_opened)
          {
            gchar *str;
            off_t cur_pos;
--- syslog-ng-2.0.4/src/logreader.c	2007-04-20 15:11:07.000000000 -0500
+++ syslog-ng-2.0.4-cgw2/src/logreader.c	2007-06-07 11:26:12.000000000 -0500
@@ -100,29 +100,32 @@
        struct stat st, followed_st;
        off_t pos;

-      pos = lseek(self->fd->fd, 0, SEEK_CUR);
-      if (pos == (off_t) -1)
-        {
-          msg_error("Error invoking seek on followed file",
-                    evt_tag_errno("error", errno),
-                    NULL);
-          return FALSE;
-        }
-
-      if (fstat(self->fd->fd, &st) < 0)
-        {
-          msg_error("Error invoking fstat() on followed file",
-                    evt_tag_errno("error", errno),
-                    NULL);
-          return FALSE;
-        }
+      if (self->fd->fd >= 0)
+	{
+	  pos = lseek(self->fd->fd, 0, SEEK_CUR);
+	  if (pos == (off_t) -1)
+	    {
+	      msg_error("Error invoking seek on followed file",
+			evt_tag_errno("error", errno),
+			NULL);
+	      return FALSE;
+	    }
+
+	  if (fstat(self->fd->fd, &st) < 0)
+	    {
+	      msg_error("Error invoking fstat() on followed file",
+			evt_tag_errno("error", errno),
+			NULL);
+	      return FALSE;
+	    }

-      if (pos < st.st_size)
-	return TRUE;
+	  if (pos < st.st_size)
+	    return TRUE;
+	}

        if (self->reader->options->follow_filename && stat(self->reader->options->follow_filename, &followed_st) != -1)
          {
-          if (st.st_ino != followed_st.st_ino)
+          if (self->fd->fd < 0 || st.st_ino != followed_st.st_ino)
              {
                /* file was moved and we are at EOF, follow the new file */
                log_pipe_notify(self->reader->control, &self->reader->super.super, NC_FILE_MOVED, self);