From 6682c9e632ef453735a3e08ac856782608bf562f Mon Sep 17 00:00:00 2001 From: =?utf8?q?Arkadiusz=20Mi=C5=9Bkiewicz?= Date: Sun, 1 Feb 2009 20:09:40 +0000 Subject: [PATCH] - one more fix Changed files: syslog-ng-fixes.patch -> 1.3 --- syslog-ng-fixes.patch | 43 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) diff --git a/syslog-ng-fixes.patch b/syslog-ng-fixes.patch index 1279fc7..3dde7c4 100644 --- a/syslog-ng-fixes.patch +++ b/syslog-ng-fixes.patch @@ -64,3 +64,46 @@ index c40b7fb..d54ba8f 100644 %% extern int linenum; +commit ef5eb95d26fcfe3746b78bba8d39cfa2cdb9eeeb +Author: Balazs Scheidler +Date: Tue Dec 30 15:22:00 2008 +0100 + + [LogReader] only assume that a file was moved if the size of the file is non-zero + + If an external logrotate program is used to rotate a logfile, a + small race still exists when using syslog-ng to read that logfile, + as described by Evan Rempel: + + " + 1. Application is writing to log file named "A". + 2. External log rotation renames "A" to "A.1" + 3. External log rotation touches/creates file named "A" and sets appropriate + permissions. + 4. Internal timer of syslog-ng is triggered by follow_freq() setting. Syslog-ng will + switch to the new file "A" because it exists, even though it was created only + milliseconds earlier. + 5. log rotation signals the application to switch log files (reload or restart). + 6. Application flushes log buffers to current file which is now A.1, but syslog-ng + is no longer reading this file. + 7. Application closes current log file "A.1" and opens new log file "A". + + This sequence will result in the last buffer flush (step 6) from the application to + be missed by syslog-ng. + " + + This patch makes syslog-ng to switch to the new log file if it already + received some data. + +diff --git a/src/logreader.c b/src/logreader.c +index f9567ff..40e2ae7 100644 +--- a/src/logreader.c ++++ b/src/logreader.c +@@ -167,7 +167,7 @@ log_reader_fd_check(GSource *source) + + if (self->reader->follow_filename && stat(self->reader->follow_filename, &followed_st) != -1) + { +- if (fd < 0 || st.st_ino != followed_st.st_ino) ++ if (fd < 0 || (st.st_ino != followed_st.st_ino && st.st_size > 0)) + { + msg_trace("log_reader_fd_check file moved eof", + evt_tag_int("pos", pos), -- 2.44.0