[syslog-ng] [Non-DoD Source] Re: Syslog 3.5 (pipe file issue)

Fri Oct 27 17:55:10 UTC 2017

Hi Laszlo,
Though wouldn't the date/timestamp on the file be updated as the data is flowing through the pipe.

Thanks
Jitesh
________________________________
From: syslog-ng [syslog-ng-bounces at lists.balabit.hu] on behalf of László Várady [laszlo.varady at balabit.com]
Sent: Friday, October 27, 2017 11:27 AM
To: Syslog-ng users' and developers' mailing list
Subject: Re: [syslog-ng] [Non-DoD Source] Re: Syslog 3.5 (pipe file issue)

All active links contained in this email were disabled. Please verify the identity of the sender, and confirm the authenticity of all links contained within the message prior to copying and pasting the address to a Web browser.

________________________________

Hi,

As Laci pointed out, this is an expected behavior.
Named pipes are not regular files, the "file size" is always 0 byte.

>From Caution-https://linux.die.net/man/4/fifo < Caution-https://linux.die.net/man/4/fifo > :
When processes are exchanging data via the FIFO, the kernel passes all data internally without writing it to the file system.

If you are interested in the capacity of named pipes, you can read about this here:
Caution-https://linux.die.net/man/7/pipe < Caution-https://linux.die.net/man/7/pipe >  (Chapter name: Pipe capacity)

--
László Várady

On Fri, Oct 27, 2017 at 4:56 PM Amin, Jitesh CTR (US) <jitesh.amin.ctr at mail.mil < Caution-mailto:jitesh.amin.ctr at mail.mil > > wrote:
Hi Laci,
So we can create named pipe object with filename successfully.

But the then the file always shows 0 bytes in size even after data is being written to this file. Additionally the timestamp on this file never changes (as new data get's written and so I would assume that modify date on file would also be updated).

Thanks
Jitesh
________________________________
From: syslog-ng [syslog-ng-bounces at lists.balabit.hu < Caution-mailto:syslog-ng-bounces at lists.balabit.hu > ] on behalf of Szemere, László [laszlo.szemere at balabit.com < Caution-mailto:laszlo.szemere at balabit.com > ]
Sent: Friday, October 27, 2017 9:46 AM
To: Syslog-ng users' and developers' mailing list
Subject: [Non-DoD Source] Re: [syslog-ng] Syslog 3.5 (pipe file issue)

All active links contained in this email were disabled. Please verify the identity of the sender, and confirm the authenticity of all links contained within the message prior to copying and pasting the address to a Web browser.

________________________________

Hello Jitesh,

 I am afraid I can not clearly understand your problem. Since OSE 3.0.2, a named pipe destination creates a new pipe object automatically with the predefined filename. (Caution-Caution-https://www.balabit.com/documents/syslog-ng-ose-3.11-guides/en/syslog-ng-ose-guide-admin/html-single/index.html#configuring-destinations-pipe < Caution-https://www.balabit.com/documents/syslog-ng-ose-3.11-guides/en/syslog-ng-ose-guide-admin/html-single/index.html#configuring-destinations-pipe >  < Caution-Caution-https://www.balabit.com/documents/syslog-ng-ose-3.11-guides/en/syslog-ng-ose-guide-admin/html-single/index.html#configuring-destinations-pipe < Caution-https://www.balabit.com/documents/syslog-ng-ose-3.11-guides/en/syslog-ng-ose-guide-admin/html-single/index.html#configuring-destinations-pipe >  > )

 For me, this is the expected behavior of named pipes (man page: Caution-Caution-http://man7.org/linux/man-pages/man1/mkfifo.1.html < Caution-http://man7.org/linux/man-pages/man1/mkfifo.1.html >  < Caution-Caution-http://man7.org/linux/man-pages/man1/mkfifo.1.html < Caution-http://man7.org/linux/man-pages/man1/mkfifo.1.html >  >  further information on level 3: Caution-Caution-http://man7.org/linux/man-pages/man3/mkfifo.3.html < Caution-http://man7.org/linux/man-pages/man3/mkfifo.3.html >  < Caution-Caution-http://man7.org/linux/man-pages/man3/mkfifo.3.html < Caution-http://man7.org/linux/man-pages/man3/mkfifo.3.html >  > ). Please try to rephrase your question, to give us more understanding about your use case.

Br,
Laci

On Fri, Oct 27, 2017 at 2:42 PM, Amin, Jitesh CTR (US) <jitesh.amin.ctr at mail.mil < Caution-mailto:jitesh.amin.ctr at mail.mil >  < Caution-Caution-mailto:jitesh.amin.ctr at mail.mil < Caution-mailto:jitesh.amin.ctr at mail.mil >  > > wrote:
Hi,
We have the syslog-ng 3.5 installed on Linux OS. We are trying to use the pipe function (to pipe data to the log file). This pipe file is FIFO.

One of the issues we are seeing is that, the file size of this pipe file is always ZERO and never grows and second the timestampe on the file never updates or changes.

Though when we do a "cat pipefilename" command we do see contents of the file.

Can you please let us know what we could be doing wrong or any feedback on how to resolve the issue?

Thanks
Jitesh

______________________________________________________________________________
Member info: Caution-Caution-https://lists.balabit.hu/ < Caution-https://lists.balabit.hu/ > mailman/listinfo/syslog-ng < Caution-Caution-https://lists.balabit.hu/mailman/listinfo/syslog-ng < Caution-https://lists.balabit.hu/mailman/listinfo/syslog-ng >  >
Documentation: Caution-Caution-http://www.balabit.com/ < Caution-http://www.balabit.com/ > support/documentation/?product=syslog-ng < Caution-Caution-http://www.balabit.com/support/documentation/?product=syslog-ng < Caution-http://www.balabit.com/support/documentation/?product=syslog-ng >  >
FAQ: Caution-Caution-http://www.balabit.com/wiki/ < Caution-http://www.balabit.com/wiki/ > syslog-ng-faq < Caution-Caution-http://www.balabit.com/wiki/syslog-ng-faq < Caution-http://www.balabit.com/wiki/syslog-ng-faq >  >

______________________________________________________________________________
Member info: Caution-https://lists.balabit.hu/mailman/listinfo/syslog-ng < Caution-https://lists.balabit.hu/mailman/listinfo/syslog-ng >
Documentation: Caution-http://www.balabit.com/support/documentation/?product=syslog-ng < Caution-http://www.balabit.com/support/documentation/?product=syslog-ng >
FAQ: Caution-http://www.balabit.com/wiki/syslog-ng-faq < Caution-http://www.balabit.com/wiki/syslog-ng-faq >

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20171027/e0a9e43a/attachment-0001.html>