Hello I have rsyslog installed on a server to inject data in postgresql database. Few days ago SQL injection stopped (because of a syntax error: bad template) As I configured disk Queue for the ompgsql action I have all the non injected messages in thousans of QIF Files. Here is the cfg: ########################## $template LogToPqsql, "insert into blablabla' );", sql $WorkDirectory /var/spool/rsyslog/work $ActionQueueType LinkedList $ActionQueueFileName dbq $ActionResumeRetryCount -1
local1.* :ompgsql:blablablabla ########################## Unfortunately after restarting rsyslog, it does not reads the files to inject it back to pg. Looking in the work dir I can't see file with the .qi extension. If I manually rename the first QIF file to dbq.qi, rsyslog crash with a segfault. Then I tried installing 4.6.3 instead of my old 4.4.2. Rsyslog do not crash anymore but complains about something wrong with my QIF file (i guess): ########################## ... 5150.884531712:40800950: deserializer has possibly been able to re-sync and recover, state 0 5150.884531712:40800950: objDeserializePropBag error -2037 during header - trying to recover 5150.884531712:40800950: strm 0x689a10: file 10 read 421 bytes 5150.884531712:40800950: strm 0x689a10: file 10 read 0 bytes 5150.884531712:40800950: deserializer has possibly been able to re-sync and recover, state -2026 5150.884531712:40800950: strm 0x689a10: file 10(/var/spool/rsyslog/work/dbq.qi) closing 5150.884531712:40800950: action 3 queue[DA]: error -2026 reading .qi file - can not read persisted info (if any) 5150.884531712:40800950: action 3 queue[DA]: persisting queue to disk, 0 entries... 5150.884531712:40800950: action 3 queue: error -2026 creating disk queue - giving up. ... ########################## Does anyone have any idea? _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
