[syslog-ng] Files still opened after time_reap

[Erwan Miran]

Balazs Scheidler a écrit :
> On Wed, 2010-07-07 at 11:18 +0200, Erwan Miran wrote:
>   
>> Hi,
>>
>> I'm using syslog-ng 2.0.0 (yes I know...) on a debian loghost. Files
>> generated via df_monitor (see configuration extract below) are deleted
>> by the monitoring process about 4 min after having been written by
>> syslog-ng.
>> My problem is that these files remain opened (lsof | grep deleted) by
>> syslog-ng after deleted whereas time_reap option is set to 30s.
>> I googled the issue and just found
>> https://lists.balabit.hu/pipermail/syslog-ng/2003-January/004416.html
>> which is not my exact case (macros are actually used in filenames).
>> I didn't find any bugfix/feature on time_reap in the changelog of
>> subsequent versions ... 
>>     
>
> Well, 2.0.0 really is ancient, and I can't really remember whether there
> was such a bug in it, but syslog-ng should definitely close those files,
> if macros are being used. (if no macros are used, time_reap is not
> applied).
>
> As a workaround, you could SIGHUP the syslog-ng process, that definitely
> closes all files.
>
>   
You're right it's an ancient one, fyi my debian version is etch (but I 
guess your answer would have been the same with 2.0.9 provided by lenny 
or even ubuntu lucid)...
I already use the workaround you describe when I detect the problem and 
will certainly have to cron the detection+sighup but it is not... neat.
Btw is the issue present in subsequent versions?

Regards
Erwan