On 17.11.2009 10:59, Neil Bothwick wrote: >>> Then how do you get the server to use the new logfile names each >>> day/week? >> It creates and uses a new file each hour/day/etc. Perhaps, you missed >> the file(...) directive? > > I didn't miss it. My question was how to you get the process to USE the > new file. Unless you SIGHUP the process, it will continue using the > config in pace when it started.
Last sentence is correct. What you are missing is that the config says to start a new file each day/hour/etc. syslog-ng does not evaluate the file() expression once at startup and then treat it as a constant. # ls /var/log/HOSTS/north/|tail -n5 north.2009.07.log.gz north.2009.08.log.gz north.2009.09.log.gz north.2009.10.log.gz north.2009.11.log There was no SIGHUP involved. >>> You only need to send a SIGHUP to the server using that log >>> facility, so syslog would not be affected in your example. >> I can't parse this. The point is avoiding SIGHUP so that we do not miss >> any log messages. > > You wouldn't miss a log messsage by sending a SIGHUP to your mail server, > the logger woulsd keep running. When syslog-ng cannot process messages for whatever reason, it will buffer them. When the buffer is full, it will drop the messages. There is no need to add to the load and increase message loss probability with SIGHUP (think of a central log server). -- Eray
