[syslog-ng] feature request?: monitor open logs for deletion/rename
algernon at balabit.hu
Wed Jul 11 10:07:19 CEST 2012
Patrick Hemmer <syslogng at stormcloud9.net> writes:
> Something which I think would be an awesome feature would be to monitor
> open file destinations for the file being renamed or deleted, and then
> reopen the file in such an event. The benefit of this is that when doing
> log rotation, you don't have to SIGHUP syslog-ng to make it re-open
> files. It would also make it so that all destination buffers don't have
> to be flushed and reopened, just the single file destination.
> The only downside is portability as not all OSs support the same way of
> doing this. On linux this can be easily done through inotify, and it
> looks like the BSD equivalent is kqueue (though I have pretty much no
> BSD experience). For platforms which there isn't a good method, we could
> instead fall back to a simple polling.
I've been thinking about something similar recently, though, my desire
started from a completely different angle: I'd love to have wildcard
file sources, and possibly other stuff (like allow some macros in file
sources, though that opens up a nasty can of worms).
That needs some kind of monitoring too, and if sources have it, we can
reuse the same thing for similar tasks on the destination side too.
I planned to write an RFC (with a little bit more detail about how I
imagine it would work, and what good things it'd bring us) about this in
the next day or two, but the rabbit's out the hat now. On the flip side,
I originally didn't think about how file monitoring could be used for
destinations, but your mail enlightened me - thank you!
More information about the syslog-ng