[syslog-ng] mismatching size/inode information

[Gbe gbe]

2011/10/7 Gergely Nagy <algernon at balabit.hu>
>
> Gbe gbe <gbeantipub at gmail.com> writes:
>
> > Hi everyone !
> >
> > I have this message in my logs repeated several times and for different
> > files :
> > « syslog-ng[964]: The current log file has a mismatching size/inode
> > information, restarting from the beginning;
> > filename='/var/log/squid3/access.log' »
>
> This means that the file has changed. This can happen due to being
> truncated, rotated away, or hardware failiure.
>
> In most cases, it's the result of log rotation, though.
>
> syslog-ng keeps track of file positions, in order to be able to continue
> wherever it left when restarted. But for that to work reliably, it also
> stores the inode and size of the file, so it can detect when a file was
> changed, and restart from the beginning.
>
> This is exactly what happens in your case: some logs get rotated, and
> syslog-ng restarts reading from the beginning of said files.
>
> Nothing to worry about. At least, if you do have rotation set up, and
> the messages come shortly after rotation happens.

That's reassuring.
However, this machine has been up for several months (I don't mean the
uptime) and has never printed those messages. As far as I know the
configuration hasn't changed recently. This is why I start suspecting
hardware failure. Nothing else in the logs tells me about any hardware
errors.