[syslog-ng] Followed files that grow while syslog-ng is reloaded

Francois Durand fdur559 at gmail.com
Sat Jun 30 17:16:19 CEST 2012

Hi list,

I'm using syslog-ng (3.2.4) to follow some nginx log files using these

source s_nginx_logs {
  file("/path/to/nginx/access.log"      flags(no-parse));

When syslog-ng is reloaded, either for its own log files rotation or
because a configuration update (which happens regularly when a new site is
added), it does not see new data being written in followed files while it
is reloading itself, and then complains about file size having changed and
retransmit the whole file to my central log file collector.

Here is the warning message:
syslog-ng[24608]: The current log file has a mismatching size/inode
information, restarting from the
beginning; state='affile_sd_curpos(/path/to/nginx/access.log)
stored_inode='139419', cur_file_inode='139419', stored_size='985114',
cur_file_size='997815', raw_stream_pos='1995630'

I don't see how to handle that correctly.

Any idea ?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20120630/74e4e2af/attachment.htm 

More information about the syslog-ng mailing list