[syslog-ng] Followed files that grow while syslog-ng is reloaded

[Francois Durand]

Hi,

On Wed, Jul 4, 2012 at 9:47 AM, Balazs Scheidler <bazsi77 at gmail.com> wrote:
>
> I don't see that the fact the file is growing while syslog-ng is being
> reloaded would cause something like this. it is designed to handle
> these cases properly.
>

Log rotation happens at 6:25. This error line happens exactly once a day,
at 6:25:02 (it is always the first line of the newly created syslog file).
The error message is quite clear about what syslog-ng is doing (and indeed
that's what is happening) and why it is doing so (the filesizes reported
are plausible. But I only assumed syslog-ng was not lying about  the fact
this was indeed the real cause of its behavior).

My configuration seems so basic to me that I can't believe I'm the only
doing such a thing and I can't understand such a classical thing is not
working for me.

I even tried to reproduce the issue with my 3.4 tree and couldn't.
>

Then I guess I'll have to try 3.4.

That may solve another issue I have, that may be related. I have several
webservers whose logs are transfered and aggregated on one central box in
the same file. I did not investigate enough to make a full report, but the
central log file is corrupted (different lines seem to mix!) and it seems
to me that's related to the previous fact since it seems to happen only to
files that are reread from the start.I thought it may happen because
syslog-ng would catch up to the end of the file with a bulk transfert and
switch to a line by line transfert afterwards, or because one line fits on
a buffer and not a whole file. Because logrotation happens at the same time
on all webservers, all bulk transfers reach the central box at the same
time. They are then written as they come and are interleaved. Because some
lines overlap between 2 buffers on one webserver, if a buffer from another
one is written in the middle, we have a corrupted log file. Is it possible ?

Thanks for the help!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20120704/acd345d7/attachment.htm