| 1 |
On 17.11.2009 10:59, Neil Bothwick wrote: |
| 2 |
>>> Then how do you get the server to use the new logfile names each |
| 3 |
>>> day/week? |
| 4 |
>> It creates and uses a new file each hour/day/etc. Perhaps, you missed |
| 5 |
>> the file(...) directive? |
| 6 |
> |
| 7 |
> I didn't miss it. My question was how to you get the process to USE the |
| 8 |
> new file. Unless you SIGHUP the process, it will continue using the |
| 9 |
> config in pace when it started. |
| 10 |
|
| 11 |
Last sentence is correct. What you are missing is that the config says |
| 12 |
to start a new file each day/hour/etc. syslog-ng does not evaluate the |
| 13 |
file() expression once at startup and then treat it as a constant. |
| 14 |
|
| 15 |
# ls /var/log/HOSTS/north/|tail -n5 |
| 16 |
north.2009.07.log.gz |
| 17 |
north.2009.08.log.gz |
| 18 |
north.2009.09.log.gz |
| 19 |
north.2009.10.log.gz |
| 20 |
north.2009.11.log |
| 21 |
|
| 22 |
There was no SIGHUP involved. |
| 23 |
|
| 24 |
>>> You only need to send a SIGHUP to the server using that log |
| 25 |
>>> facility, so syslog would not be affected in your example. |
| 26 |
>> I can't parse this. The point is avoiding SIGHUP so that we do not miss |
| 27 |
>> any log messages. |
| 28 |
> |
| 29 |
> You wouldn't miss a log messsage by sending a SIGHUP to your mail server, |
| 30 |
> the logger woulsd keep running. |
| 31 |
|
| 32 |
When syslog-ng cannot process messages for whatever reason, it will |
| 33 |
buffer them. When the buffer is full, it will drop the messages. There |
| 34 |
is no need to add to the load and increase message loss probability with |
| 35 |
SIGHUP (think of a central log server). |
| 36 |
|
| 37 |
-- |
| 38 |
Eray |
Archives