Log "tear-off" mechanism

[Peter Van Epp]

	While reading the source or waiting for Carter to comment would be 
best, as I recall argus stats the output file and when the stat changes (as
when the file gets renamed) closes and reopens the logfile (using the file name
it was given on invocation to open the new logfile) while puffing its cheeks up 
in memory with the current data until the new logfile is open and writable to.
	For your watchdog what you want to do is have the argusarchive script
write the current time when it renames the log file in to a file. When your
watchdog wakes up and finds the output file missing it looks for the file
from argusarchive, reads the time that the change was made and uses the 
elapsed time to see if there is a problem or not (if insufficient time has 
elapsed to be sure there is a problem, sleep for a while and check again to
see if a new logfile has been created). Once a new logfile is running the 
watchdog deletes the file created by argusarchive ready for the next log roll.

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada


On Tue, Jun 17, 2003 at 08:40:21AM -0400, John Hermes wrote:
> Howdy,
> 
> I am hoping someone might be able to help me understand how
> Argus deals with having the open logfile pulled out from under
> the daemon (using the argusarchive script for example). If you
> could decribe it in terms of file descriptors and pointers,
> that would be most helpful. For instance, does Argus get
> an I/O error and create a new file in response? Why does the
> OS (Linux, FreeBSD, etc.) allow me to move an open file? Why
> can't I remember this stuff from college? :-)
> 
> I have a watchdog daemon that I configured to stat the
> logfile on a continuous basis, and now I need to write a
> compatible monitor that won't mind that the file is missing
> for the few seconds before Argus creates a new logfile. Any
> info related to moving open files would be a great help!
> 
> Thanks!
> 
> -- 
> John Hermes
> Systems Engineer
> Infoglobe, Inc
> 937-225-9999 x317
> 937-226-1623 Fax
> jhermes at infoglobe.com