1 --- syslog-ng-3.0.1/src/misc.c~ 2008-11-05 20:57:42.000000000 +0100
2 +++ syslog-ng-3.0.1/src/misc.c 2009-01-16 11:43:30.896633603 +0100
12 commit 11f8d45b016107a686dbfa29497960ae3f6145ac
13 Author: Balazs Scheidler <bazsi@balabit.hu>
14 Date: Fri Jan 16 14:44:53 2009 +0100
16 [config parser] "syslog" became a reserved word, make it possible to use that as a facility name
18 In syslog-ng 3.0, "syslog" became a reserved word, thus the facility()
19 filter couldn't use it as name for the facility named syslog.
21 To avoid having to quote this word, I added a kludge to the
22 config grammar, to make it recognize syslog as a facility name
25 diff --git a/src/cfg-grammar.y b/src/cfg-grammar.y
26 index c40b7fb..d54ba8f 100644
27 --- a/src/cfg-grammar.y
28 +++ b/src/cfg-grammar.y
29 @@ -277,6 +277,7 @@ cfg_check_template(LogTemplate *template)
32 %type <cptr> string_or_number
33 +%type <cptr> facility_string
34 %type <ptr> string_list
35 %type <ptr> string_list_build
37 @@ -464,7 +465,7 @@ source_affile_option
38 affile_sd_set_pri_level(last_driver, level);
41 - | KW_FACILITY '(' string ')'
42 + | KW_FACILITY '(' facility_string ')'
46 @@ -1305,7 +1306,7 @@ filter_fac_list
53 int n = syslog_name_lookup_facility_by_name($1);
55 @@ -1499,6 +1500,11 @@ string_list_build
60 + : string { $$ = $1; };
61 + | KW_SYSLOG { $$ = strdup("syslog"); }
67 commit ef5eb95d26fcfe3746b78bba8d39cfa2cdb9eeeb
68 Author: Balazs Scheidler <bazsi@balabit.hu>
69 Date: Tue Dec 30 15:22:00 2008 +0100
71 [LogReader] only assume that a file was moved if the size of the file is non-zero
73 If an external logrotate program is used to rotate a logfile, a
74 small race still exists when using syslog-ng to read that logfile,
75 as described by Evan Rempel:
78 1. Application is writing to log file named "A".
79 2. External log rotation renames "A" to "A.1"
80 3. External log rotation touches/creates file named "A" and sets appropriate
82 4. Internal timer of syslog-ng is triggered by follow_freq() setting. Syslog-ng will
83 switch to the new file "A" because it exists, even though it was created only
85 5. log rotation signals the application to switch log files (reload or restart).
86 6. Application flushes log buffers to current file which is now A.1, but syslog-ng
87 is no longer reading this file.
88 7. Application closes current log file "A.1" and opens new log file "A".
90 This sequence will result in the last buffer flush (step 6) from the application to
91 be missed by syslog-ng.
94 This patch makes syslog-ng to switch to the new log file if it already
97 diff --git a/src/logreader.c b/src/logreader.c
98 index f9567ff..40e2ae7 100644
100 +++ b/src/logreader.c
101 @@ -167,7 +167,7 @@ log_reader_fd_check(GSource *source)
103 if (self->reader->follow_filename && stat(self->reader->follow_filename, &followed_st) != -1)
105 - if (fd < 0 || st.st_ino != followed_st.st_ino)
106 + if (fd < 0 || (st.st_ino != followed_st.st_ino && st.st_size > 0))
108 msg_trace("log_reader_fd_check file moved eof",
109 evt_tag_int("pos", pos),