[syslog-ng] Files still opened after time_reap

[Balazs Scheidler]

On Wed, 2010-07-07 at 11:18 +0200, Erwan Miran wrote:
> Hi,
> 
> I'm using syslog-ng 2.0.0 (yes I know...) on a debian loghost. Files
> generated via df_monitor (see configuration extract below) are deleted
> by the monitoring process about 4 min after having been written by
> syslog-ng.
> My problem is that these files remain opened (lsof | grep deleted) by
> syslog-ng after deleted whereas time_reap option is set to 30s.
> I googled the issue and just found
> https://lists.balabit.hu/pipermail/syslog-ng/2003-January/004416.html
> which is not my exact case (macros are actually used in filenames).
> I didn't find any bugfix/feature on time_reap in the changelog of
> subsequent versions ... 

Well, 2.0.0 really is ancient, and I can't really remember whether there
was such a bug in it, but syslog-ng should definitely close those files,
if macros are being used. (if no macros are used, time_reap is not
applied).

As a workaround, you could SIGHUP the syslog-ng process, that definitely
closes all files.

-- 
Bazsi