Latest syslog messages are delayed

Question

My program outputs info to log files with this kind of commands:

#include <syslog.h>

int main(void)
{
    openlog(NULL, LOG_PID | LOG_PERROR, LOG_USER);
    /* ... */
    syslog(LOG_INFO, "My message\n");
}

I have also created the following file 10-myconfig.conf in /etc/rsyslog.d:

# Create template for exec-name specific output files
$Template DynaFile,"/var/log/%PROGRAMNAME%.log"

# Printout format for user log
$Template UserLogFormat,"%pri-text%: %timegenerated% %syslogtag%%msg:::drop-last-lf%\n"

# Set user log
user.* ?DynaFile;UserLogFormat

As expected, the messages come both to /var/log/syslog, and to /var/log/my_program.log.

However, the last lines do not show immediately in /var/log/my_program.log. The last lines looks like there are missing, but after some more lines arrive, the missing ones appear.

It looks like there is some kind of buffer, which is not flushed to the file until full. I'd expect such a flush to occur at least at every new line, as printf does, but it doesn't seem to work like that.

How can I make sure that the log messages are immediately flushed to the log file?

Answer 1

The purpose of the syslog facility is to accept messages, possibly rapidly generated, and eventually save them in a file. Such a facility goes back to operating systems of the 1950s (maybe before).

It is normal for the log file to not have the last few messages. The messages are kept in a kernel buffer. The dmesg command accesses the memory buffer. Maybe you can use that to see the newest portion of the log?