- one more fix

Changed files:
    syslog-ng-fixes.patch -> 1.3

diff --git a/syslog-ng-fixes.patch b/syslog-ng-fixes.patch
index 1279fc79bacb85e573f7b6926c612a36cdb9ffef..3dde7c4fb2f1e372af488b80bb735b29940eb865 100644 (file)
--- a/syslog-ng-fixes.patch
+++ b/syslog-ng-fixes.patch
@@ -64,3 +64,46 @@ index c40b7fb..d54ba8f 100644
  %%
  
  extern int linenum;
+commit ef5eb95d26fcfe3746b78bba8d39cfa2cdb9eeeb
+Author: Balazs Scheidler <bazsi@balabit.hu>
+Date:   Tue Dec 30 15:22:00 2008 +0100
+
+    [LogReader] only assume that a file was moved if the size of the file is non-zero
+    
+    If an external logrotate program is used to rotate a logfile, a
+    small race still exists when using syslog-ng to read that logfile,
+    as described by Evan Rempel:
+    
+    "
+    1. Application is writing to log file named "A".
+    2. External log rotation renames "A" to "A.1"
+    3. External log rotation touches/creates file named "A" and sets appropriate
+        permissions.
+    4. Internal timer of syslog-ng is triggered by follow_freq() setting. Syslog-ng will
+        switch to the new file "A" because it exists, even though it was created only
+        milliseconds earlier.
+    5. log rotation signals the application to switch log files (reload or restart).
+    6. Application flushes log buffers to current file which is now A.1, but syslog-ng
+        is no longer reading this file.
+    7. Application closes current log file "A.1" and opens new log file "A".
+    
+    This sequence will result in the last buffer flush (step 6) from the application to
+    be missed by syslog-ng.
+    "
+    
+    This patch makes syslog-ng to switch to the new log file if it already
+    received some data.
+
+diff --git a/src/logreader.c b/src/logreader.c
+index f9567ff..40e2ae7 100644
+--- a/src/logreader.c
++++ b/src/logreader.c
+@@ -167,7 +167,7 @@ log_reader_fd_check(GSource *source)
+         
+       if (self->reader->follow_filename && stat(self->reader->follow_filename, &followed_st) != -1)
+         {
+-          if (fd < 0 || st.st_ino != followed_st.st_ino)
++          if (fd < 0 || (st.st_ino != followed_st.st_ino && st.st_size > 0))
+             {
+               msg_trace("log_reader_fd_check file moved eof",
+                         evt_tag_int("pos", pos),