[syslog-ng] Failure to source one file prevents entire syslog-ng logger from running

[Balazs Scheidler]

On Tue, 2009-04-14 at 12:58 +0100, Hari Sekhon wrote:
> Hi,
> 
>    While I was away on holiday, another sysadmin changed the path of a 
> 3rd party application logfile that I was I sourcing in syslog-ng (it 
> cannot log directly to syslog). This caused the whole syslog-ng logger 
> to basically fail to work/(re)start, giving an the error:
> 
> Starting syslog-ng: Persistent configuration file is in invalid format, 
> ignoring;
> Error opening file for reading; filename='/path/to/file.log', error='No 
> such file or directory (2)'
> Error initializing source driver; source='s_file_blah'
> 
> And auto-restarting the logger of course didn't work either since every 
> time a restart is initiated the thing simply bailed out with this error.
> 
> Shouldn't this error simply throw up a warning and continue logging the 
> rest of what's happening on the system, rather than leaving a hole in 
> the audit trail because it cannot lock in one source???
> (Even better: start regardless, do what it can and then periodically 
> check the source again, and every time it cannot get the source open, 
> log a warning in syslog so that it can be caught by the monitoring 
> infrastructure)
> 
> Any suggestions for a workaround/option to prevent anything like this 
> ever happening again in future would be welcome.

This is what syslog-ng 3.0 does by default. Every input file is checked
every follow_freq() seconds and is reopened if it did not exist.

-- 
Bazsi