[syslog-ng] feature request?: monitor open logs for deletion/rename

[Gergely Nagy]

Patrick Hemmer <syslogng at stormcloud9.net> writes:

> Something which I think would be an awesome feature would be to monitor 
> open file destinations for the file being renamed or deleted, and then 
> reopen the file in such an event. The benefit of this is that when doing 
> log rotation, you don't have to SIGHUP syslog-ng to make it re-open 
> files. It would also make it so that all destination buffers don't have 
> to be flushed and reopened, just the single file destination.
>
> The only downside is portability as not all OSs support the same way of 
> doing this. On linux this can be easily done through inotify, and it 
> looks like the BSD equivalent is kqueue (though I have pretty much no 
> BSD experience). For platforms which there isn't a good method, we could 
> instead fall back to a simple polling.

I've been thinking about something similar recently, though, my desire
started from a completely different angle: I'd love to have wildcard
file sources, and possibly other stuff (like allow some macros in file
sources, though that opens up a nasty can of worms).

That needs some kind of monitoring too, and if sources have it, we can
reuse the same thing for similar tasks on the destination side too.

I planned to write an RFC (with a little bit more detail about how I
imagine it would work, and what good things it'd bring us) about this in
the next day or two, but the rabbit's out the hat now. On the flip side,
I originally didn't think about how file monitoring could be used for
destinations, but your mail enlightened me - thank you!

-- 
|8]