[syslog-ng] Failure to source one file prevents entire syslog-ng logger from running

[Hari Sekhon]

Balazs Scheidler wrote:
> On Tue, 2009-04-14 at 12:58 +0100, Hari Sekhon wrote:
>   
>> Hi,
>>
>>    While I was away on holiday, another sysadmin changed the path of a 
>> 3rd party application logfile that I was I sourcing in syslog-ng (it 
>> cannot log directly to syslog). This caused the whole syslog-ng logger 
>> to basically fail to work/(re)start, giving an the error:
>>
>> Starting syslog-ng: Persistent configuration file is in invalid format, 
>> ignoring;
>> Error opening file for reading; filename='/path/to/file.log', error='No 
>> such file or directory (2)'
>> Error initializing source driver; source='s_file_blah'
>>
>> And auto-restarting the logger of course didn't work either since every 
>> time a restart is initiated the thing simply bailed out with this error.
>>
>> Shouldn't this error simply throw up a warning and continue logging the 
>> rest of what's happening on the system, rather than leaving a hole in 
>> the audit trail because it cannot lock in one source???
>> (Even better: start regardless, do what it can and then periodically 
>> check the source again, and every time it cannot get the source open, 
>> log a warning in syslog so that it can be caught by the monitoring 
>> infrastructure)
>>
>> Any suggestions for a workaround/option to prevent anything like this 
>> ever happening again in future would be welcome.
>>     
>
> This is what syslog-ng 3.0 does by default. Every input file is checked
> every follow_freq() seconds and is reopened if it did not exist.
>   
Ok, am on 2.x, will upgrade to 3.x.

Does it log to syslog if the source is still unavailable every 
follow_freq() secs? This would be nice so that my monitoring 
infrastructure will alert me as to this problem rather than syslog-ng 
silently failing to pick up the source.

Thanks

-h

-- 
Hari Sekhon
Always open to interesting opportunities
http://www.linkedin.com/in/harisekhon