[syslog-ng] mismatching size/inode information

[Gergely Nagy]

Gbe gbe <gbeantipub at gmail.com> writes:

> Hi everyone !
>
> I have this message in my logs repeated several times and for different
> files :
> « syslog-ng[964]: The current log file has a mismatching size/inode
> information, restarting from the beginning;
> filename='/var/log/squid3/access.log' »

This means that the file has changed. This can happen due to being
truncated, rotated away, or hardware failiure.

In most cases, it's the result of log rotation, though.

syslog-ng keeps track of file positions, in order to be able to continue
wherever it left when restarted. But for that to work reliably, it also
stores the inode and size of the file, so it can detect when a file was
changed, and restart from the beginning.

This is exactly what happens in your case: some logs get rotated, and
syslog-ng restarts reading from the beginning of said files.

Nothing to worry about. At least, if you do have rotation set up, and
the messages come shortly after rotation happens.

-- 
|8]