> -----Original Message----- > From: Michael Biebl [mailto:[email protected]] > Sent: Tuesday, August 04, 2009 2:47 PM > To: Frédéric Massot; [email protected] > Cc: Rainer Gerhards; [email protected] > Subject: Re: Bug#539739: AW: Bug#539739: rsyslog: The marks (-- MARK -- > ) are not always written > > reopen 539739 > thanks > > Frédéric Massot wrote: > > Michael Biebl a écrit : > >> Frédéric Massot wrote: > >>> If you look at the extract from the log file "messages", you see > that > >>> there would be a mark to 1h17. But there was none. > >> Right, because there was a regular syslog message in between. > >> Afaik, the mark messages work this way: > >> Whenever you receive a regular syslog message (doesn't matter into > which log > >> file they go), the mark counter is reset. > >> So only if you do not receive any regular syslog messages, you get > mark messages > >> in a regular 20 min intervall. > > > > This is surprising, because there is the hddtemp daemon that writes > > every minute in the file "syslog", but I have marks in the file > "messages". > > Seems I was simply wrong with my assumption. > I just checked the code in immark.c and when enabled it injects a MARK > message > after each iMarkMessagePeriod unconditionally. > > Rainer, any ideas why sometimes MARK messages are not written? > > Anyway, I reopened the bug report until we know more.
I have now reviewed the code. My initial posting was correct, rsyslog works as intended. While immark generates mark messages at fixed intervals, the action processor removes them if the action was recently enough called (see action.c, ln. 1189, current master branch). This handling is so that a local perception of "recently called" is kept on a per-action basis. This stems back to sysklogd, but I also think it is the correct way to handle the situation. As such, it is not important if any *other* action was called within that interval, it is only important if the action itself was called (or not) within the interval. I would probably fairly easy to add an option to *always* write mark messages if there is a real need for such. As of rsyslog policies, that will probably only go into v5 (maybe v4, but definitely not v3). Please let me know your thoughts. Rainer
