--- Begin Message ---
Package: rsyslog
Version: 8.1901.0-1
Experiencing bug with continuously restarting omfile threads and
opening/closing the files many times per second.
Restarting the rsyslog solve the issue which reoccur again on ?logrotation?
(not proved).
root@fwd01:~# date; pstree -t -sap 9276
Tue 05 May 2020 08:05:27 AM UTC
systemd,1
└─rsyslogd-local,9276 -n -f /etc/rsyslog.d/rsyslog-local.conf
├─{in:impstats},9279
├─{in:imptcp},9281
├─{in:imptcp},9282
├─{in:imptcp},9283
├─{in:imudp},9280
├─{rs:ESP01-SURI q},6817
├─{rs:ESP03-WEB qu},9438
├─{rs:SIEMEP2 queu},6818
├─{rs:apache-site-},1001
├─{rs:apache-site-},1002
├─{rs:apache-site-},1003
├─{rs:haproxy.log},729
├─{rs:haproxy.log},992
├─{rs:local-all.lo},999
├─{rs:main Q:Reg},9437
├─{rs:nginx-site-a},914
├─{rs:nginx-site-a},987
├─{rs:nginx-site-e},986
├─{rs:nginx-site-e},989
├─{rsyslogd-local},9277
└─{rsyslogd-local},9278
root@fwd01:~# date; pstree -t -sap 9276
Tue 05 May 2020 08:05:31 AM UTC
systemd,1
└─rsyslogd-local,9276 -n -f /etc/rsyslog.d/rsyslog-local.conf
├─{in:impstats},9279
├─{in:imptcp},9281
├─{in:imptcp},9282
├─{in:imptcp},9283
├─{in:imudp},9280
├─{rs:ESP01-SURI q},6817
├─{rs:ESP03-WEB qu},9438
├─{rs:SIEMEP2 queu},6818
├─{rs:apache-site-},1281
├─{rs:haproxy.log},1034
├─{rs:haproxy.log},1266
├─{rs:local-all.lo},1277
├─{rs:local-all.lo},1278
├─{rs:main Q:Reg},9437
├─{rs:nginx-site-a},1261
├─{rs:nginx-site-a},1273
├─{rs:nginx-site-e},1223
├─{rs:nginx-site-e},1260
├─{rsyslogd-local},9277
├─{rsyslogd-local},9278
└─{rsyslogd-local},1276
And stable list of threads after restart
root@bts-locofwd01:~# date; pstree -t -sap 12417
Tue 05 May 2020 08:15:06 AM UTC
systemd,1
└─rsyslogd-local,12417 -n -f /etc/rsyslog.d/rsyslog-local.conf
├─{in:impstats},12420
├─{in:imptcp},12422
├─{in:imptcp},12423
├─{in:imptcp},12424
├─{in:imudp},12421
├─{rs:ESP03-GWS qu},14096
├─{rs:ESP03-WAF qu},14094
├─{rs:ESP03-WEB qu},14092
├─{rs:local-all.lo},14089
├─{rs:local-all.lo},14090
├─{rs:local-all.lo},14091
├─{rs:main Q:Reg},14088
├─{rs:nginx-server},14097
├─{rs:nginx-site-a},14093
├─{rs:nginx-site-e},14095
├─{rsyslogd-local},12418
└─{rsyslogd-local},12419
root@bts-locofwd01:~# date; pstree -t -sap 12417
Tue 05 May 2020 08:15:36 AM UTC
systemd,1
└─rsyslogd-local,12417 -n -f /etc/rsyslog.d/rsyslog-local.conf
├─{in:impstats},12420
├─{in:imptcp},12422
├─{in:imptcp},12423
├─{in:imptcp},12424
├─{in:imudp},12421
├─{rs:ESP03-GWS qu},14096
├─{rs:ESP03-WAF qu},14094
├─{rs:ESP03-WEB qu},14092
├─{rs:local-all.lo},14089
├─{rs:local-all.lo},14090
├─{rs:local-all.lo},14091
├─{rs:main Q:Reg},14088
├─{rs:nginx-server},14097
├─{rs:nginx-site-a},14093
├─{rs:nginx-site-e},14095
├─{rsyslogd-local},12418
└─{rsyslogd-local},12419
Running updated Debian10 with backported kernel version 5.4.0-0.bpo.2-amd64.
Peter
--- End Message ---