[syslog-ng] Using mount file as source

[Balazs Scheidler]

On Fri, 2009-08-28 at 08:26 +0200, G. Rayot wrote:
> Hi.
> 
> Using syslog-ng OSE, is it possible to use a remote file (ie: samba
> share) as source file?
> Doing it with a local file works like a charm, but using a mounted
> remote file does not work (with follow_freq set to 1 or not set). The
> file will be read by syslog-ng only if I make a ls on the folder where
> the file is mounted, or cat the file. Otherwise, syslog-ng seems to
> not see any change in the file.

Hm... this might be a filesystem issue. In order to have the file
checked if some more data was appended to it, syslog-ng performs an
fstat() on the opened file. This information may be cached by smbfs/cifs
on the client side.

As I see smbfs indeed does some time based caching:


        /*
         * Check whether we've recently refreshed the inode.
         */
        if (time_before(jiffies, SMB_I(inode)->oldmtime + SMB_MAX_AGE(s))) {
                VERBOSE("up-to-date, ino=%ld, jiffies=%lu, oldtime=%lu\n",
                        inode->i_ino, jiffies, SMB_I(inode)->oldmtime);
                goto out;
        }


Have you tried using cifs instead of smbfs? That seems to be the current client side 
implementation of SMBFS these days.

-- 
Bazsi