[syslog-ng] lsof shows open files which should be closed

[Evan Rempel]

I know nothing of the timer architecture used within syslog-ng, but just to create
discussion, could it be that a completed timer is missed? Something like
one timer completes and while it is being processed (the file is being closed/reaped)
another timer completes which is missed. This would probably only
show up on systems that have been configured to log to a large number of files.

Evan.


Balazs Scheidler wrote:
> On Thu, 2007-12-20 at 19:42 +0100, Balazs Scheidler wrote:
>> On Thu, 2007-12-20 at 15:22 +0100, Nagy Daniel wrote:
>>> Hi,
>>>
>>> At 15:00 there are many "Initializing destination file writer..."
>>> messages, which is good:
>>>
>>> Dec 20 15:00:01 s_sys at barapp1 syslog-ng[18883]: Initializing destination
>>> file writer; template='/data/syslog/FM-$YEAR$MONTH$DAY-$HOU
>>> R0000-$HOST.log', filename='/data/syslog/FM-20071220-150000-fm12.log'
>>>
>>> But from 15:00 to 15:19 there are no "Destination timed out, reaping"
>>> messages at all, and all files opened at 14:00 are still open according
>>> to lsof.
>>>
>>> Every server share a common NTP server, time is good.
>> I don't see how syslog-ng could start the timer which reaps files, the
>> only reason that could explain this is the continous stream of incoming
>> messages, which makes this timer starve.
> 
> I mean I could not see how it would not start. E.g. it is always started
> if there's at least one '$' character in the filename.
> 
> 


-- 
Evan Rempel                erempel at uvic.ca
Senior Programmer Analyst        250.721.7691
Computing Services
University of Victoria