[syslog-ng] lsof shows open files which should be closed

[Balazs Scheidler]

On Thu, 2007-12-20 at 15:22 +0100, Nagy Daniel wrote:
> Hi,
> 
> At 15:00 there are many "Initializing destination file writer..."
> messages, which is good:
> 
> Dec 20 15:00:01 s_sys at barapp1 syslog-ng[18883]: Initializing destination
> file writer; template='/data/syslog/FM-$YEAR$MONTH$DAY-$HOU
> R0000-$HOST.log', filename='/data/syslog/FM-20071220-150000-fm12.log'
> 
> But from 15:00 to 15:19 there are no "Destination timed out, reaping"
> messages at all, and all files opened at 14:00 are still open according
> to lsof.
> 
> Every server share a common NTP server, time is good.

I don't see how syslog-ng could start the timer which reaps files, the
only reason that could explain this is the continous stream of incoming
messages, which makes this timer starve.

The main loop of syslog-ng uses priorities to prioritize incoming
events, the "reaper" timer uses a low priority, incoming messages use a
higher value. If there's a higher priority event the lower priority is
not checked.

Can you verify that this patch fixes this issue? Thanks in advance.

diff --git a/src/affile.c b/src/affile.c
index a0e7cc8..ccc6388 100644
--- a/src/affile.c
+++ b/src/affile.c
@@ -652,7 +652,7 @@ affile_dd_init(LogPipe *s, GlobalConfig *cfg, PersistentConfig *persist)
   
   if ((self->flags & AFFILE_NO_EXPAND) == 0)
     {
-      self->reap_timer = g_timeout_add_full(G_PRIORITY_LOW, self->time_reap * 1000 / 2, affile_dd_reap, self, NULL);
+      self->reap_timer = g_timeout_add_full(G_PRIORITY_DEFAULT, self->time_reap * 1000 / 2, affile_dd_reap, self, NULL);
       self->writer_hash = persist_config_fetch(persist, affile_dd_format_persist_name(self));
       if (self->writer_hash)
         g_hash_table_foreach(self->writer_hash, affile_dd_reuse_writer, self);


-- 
Bazsi