[syslog-ng] Collect log from beginning incase central server's log file gets deleted.

[Balazs Scheidler]

----- Original message -----
> Hi,
> 
> Below is my setup (see the config details). Issue i am facing is :
> 
> Lets say on central servers apache logs are collected till 2:00 PM for
> current date. Incase if i delete the log file on central server, a new
> file gets created and starts collecting the log after the delete time ie
> 2:00 PM. What i want to achieve is that in such an event where the log
> files gets deleted.. the new log-file will collect the log from the
> beginning of the day ie 12:00 AM. Is this possible ?

no, syslog-ng is not file based, it is tailing logfiles and reads messages one by one. the server stores these messages in its configured destinations. the source and destination files are only connected through the configurations of the client and server. thus syslog-ng has no way of knowing whether a file was deleted or not.

using rsync might be an option though.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20121025/228ffae7/attachment.htm