[syslog-ng] Behavior when followed files are renamed

[Balazs Scheidler]

On Thu, 2008-12-11 at 18:01 -0500, Joe Shaw wrote:
> Hi,
> 
> On Thu, Dec 11, 2008 at 5:37 PM, Balazs Scheidler <bazsi at balabit.hu> wrote:
> > On Thu, 2008-12-11 at 15:23 -0500, Joe Shaw wrote:
> >> I couldn't find this anywhere in the online docs.  What's the behavior
> >> of syslog-ng OSE when a file which is being followed with
> >> follow_freq() is renamed?
> >
> > It will be read until EOF, and then if a new file happens to be there at
> > the same location, syslog-ng starts reading the new file. e.g. it
> > handles rotated logfiles just fine. Although I don't know if this is
> > your intention or not.
> 
> Ah, ok, thanks for the info!  I think this is probably what I want,
> but I am worried about a race condition.  Consider the following
> scenario:
> 
> 1. Some app is writing to a log file, and another program is
> monitoring when the logs should be rolled.
> 
> 2. The log rolling program renames the file on disk, and the app
> continues to write to the renamed file because it still has a file
> descriptor open to it.
> 
> 3. The log rolling program signals to the app to close and reopen its
> log file; the app is writing out to its fixed log file location again.
> 
> Assuming that syslog-ng is monitoring the file, is there a possibility that:
> 
> 1. The file is renamed
> 2. syslog-ng is fully caught up and hits the EOF
> 3. The new file isn't created yet, but syslog-ng is waiting for it to be created
> 4. The app continues to write some data out to the old, renamed file
> 5. The app is signaled and reopens the file; syslog-ng starts monitoring it
> 
> I am making an assumption in #3 which might not be true -- that
> syslog-ng when it encounters EOF but the file isn't recreated that
> it'll abandon the renamed file.  If that's not true, then there's no
> race and I'm happy. :)

It will not abandon it, but will check for the new file every
follow_freq() seconds.

-- 
Bazsi