[syslog-ng] lsof shows open files which should be closed

Balazs Scheidler bazsi at balabit.hu
Thu Dec 20 21:27:25 CET 2007


On Thu, 2007-12-20 at 19:42 +0100, Balazs Scheidler wrote:
> On Thu, 2007-12-20 at 15:22 +0100, Nagy Daniel wrote:
> > Hi,
> > 
> > At 15:00 there are many "Initializing destination file writer..."
> > messages, which is good:
> > 
> > Dec 20 15:00:01 s_sys at barapp1 syslog-ng[18883]: Initializing destination
> > file writer; template='/data/syslog/FM-$YEAR$MONTH$DAY-$HOU
> > R0000-$HOST.log', filename='/data/syslog/FM-20071220-150000-fm12.log'
> > 
> > But from 15:00 to 15:19 there are no "Destination timed out, reaping"
> > messages at all, and all files opened at 14:00 are still open according
> > to lsof.
> > 
> > Every server share a common NTP server, time is good.
> 
> I don't see how syslog-ng could start the timer which reaps files, the
> only reason that could explain this is the continous stream of incoming
> messages, which makes this timer starve.

I mean I could not see how it would not start. E.g. it is always started
if there's at least one '$' character in the filename.


-- 
Bazsi



More information about the syslog-ng mailing list