[syslog-ng] lsof shows open files which should be closed

Balazs Scheidler bazsi at balabit.hu
Thu Dec 20 12:59:19 CET 2007


On Thu, 2007-12-20 at 11:57 +0100, Balazs Scheidler wrote:
> On Thu, 2007-12-20 at 10:38 +0100, Nagy Daniel wrote:
> > Hello,
> > 
> > The current option is time_reap(10), and according to lsof the files
> > are still open after several minutes.
> > 
> 
> hm... can you enable "verbose" logging using the -v option? it should
> display a message like this:
> 
> 
>       msg_verbose("Destination timed out, reaping", 
>                   evt_tag_str("template", self->filename_template->template->str),
>                   evt_tag_str("filename", dw->filename->str),
>                   NULL);

One additional note:
 * are your clocks set properly? because some messages may arrive
several minutes later which keep the given destination alive.

Which macros are you using in the name of the destination file? The ones
with an R_ prefix contain the "received" time, the S_ prefix contain the
time as received in the message.

-- 
Bazsi



More information about the syslog-ng mailing list