With syslog-ng how can I reset an environment variable without losing log messages?

Question

On this system, imagine that there is a program that detects whether or not it is day or night and sets and environment variable DAY. My environment variable DAY is picked up and used in this working fragment:

log {
    source {
        file("/var/log/special/xxx" flags(no-parse) );
    };
    destination {
        file("/var/log/special/yyy" template("`DAY` $MESSAGE\n"));
    };
};

But eventually I'll need to change DAY to "night". I experimented with global variables, but those are not retained between log messages nor can you use a rewrite rule and set DAY.

I think I could write a script that would run when it got dark that would update /etc/profile.d/day.csh

setenv DAY night

and do a systemctl restart syslog-ng

Wouldn't that put me at risk of losing some log messages? I am writing to tcp() and amqp() destinations that I would image would get aborted.

Would it be better to HUP it?

Is there an approach I missed?

This might better be done with python via a template: https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html/reference-template-functions.html — thrig, Jan 31 '17 at 21:03
Embedded Python turns out to be quite powerful. I was able to use Python to compute a result and I didn't even need the environment variable after all. — tpc1095, Feb 09 '17 at 22:24

score 0 · Accepted Answer · answered Feb 01 '17 at 08:09

If you are also using diskbuffer in syslog-ng (available in version 3.9) for the destinations, then you shouldn't lose messages during the restart on that side. (BTW, reloading the syslog-ng configuration should be enough, for example, syslog-ng-ctl reload). The source side might be more problematic if the message rate is very high and you are using unreliable protocols on the source side (for example, UDP).

But as thrig suggested, a better approach would be to write a template function in Python that queries an external process/environment variable.

This answer the loss of messages part – tpc1095 Feb 09 '17 at 22:23 — tpc1095, Feb 09 '17 at 22:23

With syslog-ng how can I reset an environment variable without losing log messages?

1 Answers1