[syslog-ng] Files still opened after time_reap

[Erwan Miran]

Hi,

I'm using syslog-ng 2.0.0 (yes I know...) on a debian loghost. Files
generated via df_monitor (see configuration extract below) are deleted by
the monitoring process about 4 min after having been written by syslog-ng.
My problem is that these files remain opened (lsof | grep deleted) by
syslog-ng after deleted whereas time_reap option is set to 30s.
I googled the issue and just found
https://lists.balabit.hu/pipermail/syslog-ng/2003-January/004416.html which
is not my exact case (macros are actually used in filenames).
I didn't find any bugfix/feature on time_reap in the changelog of subsequent
versions ...

Thanks in advance for your help

Regards
Erwan


options {
        chain_hostnames(0);
        time_reopen(10);
        time_reap(30);
        log_fifo_size(8192);
        create_dirs(yes);
        group(adm);
        perm(0660);
        dir_group(adm);
        dir_perm(0755);
        use_dns(no);
        log_msg_size(4096);
        use_fqdn(yes);
        keep_hostname(yes);
        use_time_recvd(no);
};
source s_machines {
        tcp(ip("890.123.456.789") port(514) max_connections(100));
};
template tpl_monitor {
        template("$S_YEAR-$S_MONTH-$S_DAY $S_HOUR:$S_MIN:$S_SEC $FULLHOST
==$LEVEL== [$PROGRAM] $MESSAGE\n");
        template_escape(no);
};
destination df_monitor {
        file("/var/log/monitor/$R_YEAR-$R_MONTH-$R_DAY-$R_HOUR-$R_MIN"
template(tpl_monitor) group(monitor) dir_perm(0775) dir_group(monitor)
owner(loghost-maintainer));
};
destination dh_backup-loghost {
        tcp("123.456.789.890" port(514));
};
log{
        source(s_machines);
        destination(df_monitor);
        destination(dh_backup-loghost);
};
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20100707/29f97158/attachment.htm