[syslog-ng] file follow and new-file detection logic

[Balazs Scheidler]

On Wed, 2008-03-12 at 08:33 -0700, Evan Rempel wrote:
> syslog-ng 2.0.8
> 
> I am just starting to use the "file" source to follow files and
> would like to make a suggestion as to how this mechanism should work.
> 
> Currently I understand that on startup, syslog-ng reads the persistent
> data file to determine where is "left off" in a file and resumes from that location.
> My concern is what it does if the file is no longer the same file.
> 
> It seems that in the case where the file has changed, that none of the existing
> data in the file is processed by syslog-ng, and only new data arriving in the file
> is processed.
> 
> I propose that the information saved in the persistent file should include
> the offset within the file, and upon starting, if the offset does not match
> a line break, then the file is no longer the same file and should be processed
> from the beginning. Also, if the file is smaller than the offset, it is a new file
> and should be processed from the beginning.

With the new serialize framework in 2.1 I can add the inode number of
the file to the persistent information.

This way I can decide whether it's the same file (same inode) or not.

Does that sound ok for you?

-- 
Bazsi