[syslog-ng] Question about reopening sockets

[Zoltan HERPAI]

Hi Sandor,

As per the lsof output, syslog-ng does detect immediately when the socket 
gets removed (showing up as deleted), even before I send another test log 
message into the given destination. Also, even if I modify the time_reopen 
value down to 1, the socket does not get reopened after any given time. 
time_reap is set, and I can see that f.e. user.log gets closed and 
reopened with a new file handler, so some kind of close/open does happen.

(This syslog-ng is provided by Ubuntu, 2.0.9-4.1, if this is of any help.)

I do agree that I should move up to syslog-ng 2.1 or 3.0, but since this 
version (2.0.7 or 2.0.9) is provided by most of the distributions, and 
this app would be released into the wild at some point, I would not really 
want to depend on features or versions of syslog-ng that are not available 
generally.

Thanks,
Zoltan HERPAI

On Sat, 4 Jul 2009, Sandor Geller wrote:

> Hi Zoltan,
>
> syslog-ng doesn't detect the broken connection until it tries to write
> to the socket. When the write error occurs then it will try to
> reconnect to the socket and keeps to do so until it succeeds. You can
> control how many seconds to wait between retries using the time_reopen
> option.
>
> You should consider migrating to 2.1 or even better to 3.0, both are
> backward-compatible with the configuration file syntax of syslog-ng
> 2.0. AFAIK syslog-ng 2.0 isn't maintained anymore, and slowly
> syslog-ng 2.1 will get "abandoned" as well.
>
> Regards,
>
> Sandor
>
> On Fri, Jul 3, 2009 at 10:16 PM, Zoltan HERPAI<wigyori at uid0.hu> wrote:
>> Hi all,
>>
>> I'm writing a small script that would be fed with data via pipe by
>> syslog-ng 2.0.9. The script itself is responsible for creating the
>> socket into which syslog-ng would be writing to. I'm looking for an
>> option within syslog-ng that would allow for reopening the socket in
>> case the script dies, quits, or it gets removed for some reason (like an
>> epic admin fail).
>>
>> I did some testing, and as per that, checking with lsof, syslog-ng opens
>> the socket only on the first time it would be writing to that
>> destination, which is good. After the socket gets removed, it shows up as...
>>
>> syslog-ng 31666        root   17u     FIFO      253,2
>> 24624 /tmp/pw.sock (deleted)
>>
>> ... in lsof, and the deleted flag does not go away after the socket gets
>> recreated (f.e. the script is restarted), and a test message is sent
>> into the given destination. Is there a config option available for
>> reopening sockets?
>>
>> Thanks,
>> Zoltan HERPAI
>>
>> ______________________________________________________________________________
>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
>> FAQ: http://www.campin.net/syslog-ng/faq.html
>>
>>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
>