[syslog-ng] file() source driver on regular file

[Balazs Scheidler]

On Mon, 2010-07-05 at 17:51 +0300, Risto Vaarandi wrote:
> hi all,
> 
> is file() driver intended for reading kernel messages only on Linux, or 
> does it work for regular files also? I've tried to get the following 
> simple configuration working, but without success:
> 
> source textfile { file("/home/risto/test.log" flags(no-parse) 
> follow-freq(1)); };
> destination testlog { file("/var/log/test.log"); };
> log { source(textfile); destination(testlog); };
> 
> The source definition is identical to the example from the syslog-ng 
> administrator guide (I've played with the options, but the result is the 
> same).
> 
> When syslog-ng starts up, it produces the following error messages:
> 
> Follow-mode file source not found, deferring open; 
> filename='/home/risto/test.log'
> The current log file has a mismatching size/inode information, 
> restarting from the beginning; filename='/home/risto/test.log'


If the file is not there, it should try to open this file once every
second (follow_freq() intervals).

> 
> If /home/risto/test.log does not exist, only the first message is 
> produced. Is reading from regular files only supported by PE? (I am 
> using the 3.0.7 open source version of syslog-ng.)

No, it should work with 3.0 OSE as well (even prior to that).

However, I know about a bug in 3.0.7 which causes syslog-ng it
incorrectly flush destination files. Do you perhaps use flush_lines(),
flush_timeout() options?

-- 
Bazsi