[syslog-ng] lsof shows open files which should be closed

[Nagy Daniel]

Hi,

At 15:00 there are many "Initializing destination file writer..."
messages, which is good:

Dec 20 15:00:01 s_sys at barapp1 syslog-ng[18883]: Initializing destination
file writer; template='/data/syslog/FM-$YEAR$MONTH$DAY-$HOU
R0000-$HOST.log', filename='/data/syslog/FM-20071220-150000-fm12.log'

But from 15:00 to 15:19 there are no "Destination timed out, reaping"
messages at all, and all files opened at 14:00 are still open according
to lsof.

Every server share a common NTP server, time is good.

Bye,

Daniel



Balazs Scheidler wrote:
> On Thu, 2007-12-20 at 11:57 +0100, Balazs Scheidler wrote:
>> On Thu, 2007-12-20 at 10:38 +0100, Nagy Daniel wrote:
>>> Hello,
>>>
>>> The current option is time_reap(10), and according to lsof the files
>>> are still open after several minutes.
>>>
>> hm... can you enable "verbose" logging using the -v option? it should
>> display a message like this:
>>
>>
>>       msg_verbose("Destination timed out, reaping", 
>>                   evt_tag_str("template", self->filename_template->template->str),
>>                   evt_tag_str("filename", dw->filename->str),
>>                   NULL);
> 
> One additional note:
>  * are your clocks set properly? because some messages may arrive
> several minutes later which keep the given destination alive.
> 
> Which macros are you using in the name of the destination file? The ones
> with an R_ prefix contain the "received" time, the S_ prefix contain the
> time as received in the message.
>