[syslog-ng] Followed files that grow while syslog-ng is reloaded

[Balazs Scheidler]

Hi,

I don't see that the fact the file is growing while syslog-ng is being
reloaded would cause something like this. it is designed to handle
these cases properly.

I even tried to reproduce the issue with my 3.4 tree and couldn't.

There was one related change in 3.2.5 though:

Author: Balazs Scheidler <bazsi at balabit.hu>  2011-05-29 19:47:19
Committer: Balazs Scheidler <bazsi at balabit.hu>  2011-10-08 12:33:16
Parent: e231e957d13af412f38db817e2621a4ece8ebe8a (LogProto:
apply_state shouldn't allow file offsets over the end-of-file)
Child:  32650278fb35fb6f82522df54014c8d57f1705aa ([persist]: only
check the buffer size if no encoding is specified)
Branches: master, remotes/origin/master
Follows: v3.2.4
Precedes: v3.2.5

    LogProtoBufferedServer: fixed error handling in case the
persist-state cannot be restored

    In case an error happens while restoring the persist data, be sure to reset
    various state variables to indicate that the Protocol is to be restarted.

    Signed-off-by: Balazs Scheidler <bazsi at balabit.hu>

But that would only trigger the error message if for some reason
syslog-ng couldn't restore the state earlier.

On Sat, Jun 30, 2012 at 5:16 PM, Francois Durand <fdur559 at gmail.com> wrote:
> Hi list,
>
> I'm using syslog-ng (3.2.4) to follow some nginx log files using these
> directives:
>
> source s_nginx_logs {
>   file("/path/to/nginx/access.log"      flags(no-parse));
> }
>
> When syslog-ng is reloaded, either for its own log files rotation or because
> a configuration update (which happens regularly when a new site is added),
> it does not see new data being written in followed files while it is
> reloading itself, and then complains about file size having changed and
> retransmit the whole file to my central log file collector.
>
> Here is the warning message:
> syslog-ng[24608]: The current log file has a mismatching size/inode
> information, restarting from the beginning;
> state='affile_sd_curpos(/path/to/nginx/access.log) stored_inode='139419',
> cur_file_inode='139419', stored_size='985114', cur_file_size='997815',
> raw_stream_pos='1995630'
>
> I don't see how to handle that correctly.
>
> Any idea ?
>
>
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>



-- 
Bazsi