[syslog-ng] Patch for following logfiles

[Balazs Scheidler]

On Mon, 2007-12-03 at 17:15 -0600, Charles G Waldman wrote:
> Sirs:
> 
>     Several months ago I submitted the following patch to syslog-ng, which
> makes the "file" source work even if the file is not present when syslog-ng
> starts up.  (Consider the scenario where syslog-ng starts up before some
> other service which logs to a file, and that file has not yet been created
> yet.)   This patch causes syslog-ng to treat the transition from "nonexistent"
> to "existent" the same as if the file were moved/renamed.
> 
>     We are using the patched version of syslog-ng in our project and find this
> modification helpful.  It is a very non-intrusive change, and I cannot see any
> negative side-effects.  I would like to know if there is any chance for this
> patch to be incorporated into the official distribution.  Thanks for your
> consideration.

I've received your CLA, thanks.

I'm integrating your patch right now.

> Patch:  (also available as http://repo.mwt2.org/viewvc/patches/syslog-ng-file-source.patch )
> 
> --- syslog-ng-2.0.4/src/affile.c	2007-04-19 14:37:16.000000000 -0500
> +++ syslog-ng-2.0.4-cgw2/src/affile.c	2007-06-07 11:41:00.000000000 -0500
> @@ -134,7 +134,7 @@
>           gint fd;
> 
>           msg_verbose("Follow-mode file source moved, tracking of the new file is started",
> -                    evt_tag_str("file", self->filename->str),
> +                    evt_tag_str("filename", self->filename->str),
>                       NULL);
> 
>           log_pipe_deinit(self->reader, NULL, NULL);
> @@ -170,14 +170,26 @@
>   {
>     AFFileSourceDriver *self = (AFFileSourceDriver *) s;
>     gint fd;
> +  gboolean file_opened, open_deferred=FALSE;
> 
>     log_reader_options_init(&self->reader_options, cfg);
> 
> -  if (affile_sd_open_file(self, &fd))
> +  file_opened = affile_sd_open_file(self, &fd);
> +
> +  if (!file_opened && self->reader_options.follow_freq > 0)
> +    {
> +      msg_info("Follow-mode file source not found, deferring open",
> +	       evt_tag_str("filename", self->filename->str),
> +	       NULL);
> +      open_deferred = TRUE;
> +      fd = -1;
> +    }
> +
> +  if (file_opened || open_deferred)
>       {
>         self->reader = log_reader_new(fd_read_new(fd, 0), LR_LOCAL | LR_NOMREAD, s, &self->reader_options);
> 
> -      if (persist)
> +      if (persist && file_opened)
>           {
>             gchar *str;
>             off_t cur_pos;
> --- syslog-ng-2.0.4/src/logreader.c	2007-04-20 15:11:07.000000000 -0500
> +++ syslog-ng-2.0.4-cgw2/src/logreader.c	2007-06-07 11:26:12.000000000 -0500
> @@ -100,29 +100,32 @@
>         struct stat st, followed_st;
>         off_t pos;
> 
> -      pos = lseek(self->fd->fd, 0, SEEK_CUR);
> -      if (pos == (off_t) -1)
> -        {
> -          msg_error("Error invoking seek on followed file",
> -                    evt_tag_errno("error", errno),
> -                    NULL);
> -          return FALSE;
> -        }
> -
> -      if (fstat(self->fd->fd, &st) < 0)
> -        {
> -          msg_error("Error invoking fstat() on followed file",
> -                    evt_tag_errno("error", errno),
> -                    NULL);
> -          return FALSE;
> -        }
> +      if (self->fd->fd >= 0)
> +	{
> +	  pos = lseek(self->fd->fd, 0, SEEK_CUR);
> +	  if (pos == (off_t) -1)
> +	    {
> +	      msg_error("Error invoking seek on followed file",
> +			evt_tag_errno("error", errno),
> +			NULL);
> +	      return FALSE;
> +	    }
> +
> +	  if (fstat(self->fd->fd, &st) < 0)
> +	    {
> +	      msg_error("Error invoking fstat() on followed file",
> +			evt_tag_errno("error", errno),
> +			NULL);
> +	      return FALSE;
> +	    }
> 
> -      if (pos < st.st_size)
> -	return TRUE;
> +	  if (pos < st.st_size)
> +	    return TRUE;
> +	}
> 
>         if (self->reader->options->follow_filename && stat(self->reader->options->follow_filename, &followed_st) != -1)
>           {
> -          if (st.st_ino != followed_st.st_ino)
> +          if (self->fd->fd < 0 || st.st_ino != followed_st.st_ino)
>               {
>                 /* file was moved and we are at EOF, follow the new file */
>                 log_pipe_notify(self->reader->control, &self->reader->super.super, NC_FILE_MOVED, self);
> 
> 
> 
> _______________________________________________
> syslog-ng maillist  -  syslog-ng at lists.balabit.hu
> https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
> 
> 
-- 
Bazsi