[syslog-ng] Followed files that grow while syslog-ng is reloaded

[Francois Durand]

Hi list,

I'm using syslog-ng (3.2.4) to follow some nginx log files using these
directives:

source s_nginx_logs {
  file("/path/to/nginx/access.log"      flags(no-parse));
}

When syslog-ng is reloaded, either for its own log files rotation or
because a configuration update (which happens regularly when a new site is
added), it does not see new data being written in followed files while it
is reloading itself, and then complains about file size having changed and
retransmit the whole file to my central log file collector.

Here is the warning message:
syslog-ng[24608]: The current log file has a mismatching size/inode
information, restarting from the
beginning; state='affile_sd_curpos(/path/to/nginx/access.log)
stored_inode='139419', cur_file_inode='139419', stored_size='985114',
cur_file_size='997815', raw_stream_pos='1995630'

I don't see how to handle that correctly.

Any idea ?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20120630/74e4e2af/attachment.htm