Search code examples
syslogsyslog-ng

syslog-ng processing all messages after restart

i'm running syslog-ng inside docker, i'm collecting logs from local files, process them and then write to another logfile or send them to slack.

I noticed that whenever i need to updated syslog-ng config and restart container, syslog-ng re-reads all messages from source logfiles which causes duplications in destination files, slack channel.

Is there option to tell syslog that after reboot only new messages should be processed or maybe process only 1hour old logfiles?

i tried to google/check documentation but without luck, i'm probably not asking the question correctly because i would assume this option exist or not? thanks

Solution

  • syslog-ng, by default, persists positions for sources where the concept of "bookmarking" or "position-tracking" is applicable.

    This is true for regular file sources as well. All you have to do is keep the syslog-ng persist file intact (syslog-ng.persist under the /var folder).