[syslog-ng] "Illegal seek" with file("/proc/net/xt_recent/violators")

[Valentijn Sessink]

Hi Evan,

Unfortunately:

On 09-09-13 17:28, Evan Rempel wrote:
> Could the file be kept open but lseek(0) before each write, rather than
> lseek("end") before each write?

No. That's what I thought after looking in the xt_recent.c source. But 
unfortunately, lseek() seems to alter the file reading position, but not 
the writing position. See here the strange effects: 
https://plus.google.com/109970014070894558897/posts/bX35vy6s1mS

I even compiled a version with lseek(..,0,0) instead of (..0,2), but it 
did not function.

> Perhaps a flag to seek to the beginning (rewrite(true) ) would work as
> a concept.

lseek() doesn't work, due to a half baked implementation in /proc.

(Sorry for the misunderstanding; part of this discussion was off-list 
between Balasz and me, he most generously patched syslog-ng for me but 
it didn't work).

Best regards,

Valentijn