On Tue, 9 Nov 2010, John Feuerstein wrote:
Here is the whole server config:
$ModLoad imuxsock
# Default syslog file format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
# Never filter duplicated messages
$RepeatedMsgReduction off
# We need these for further analysis
$EscapeControlCharactersOnReceive off
$FileOwner syslog
$FileGroup syslog
$FileCreateMode 0640
$DirCreateMode 0750
$Umask 0027
$PrivDropToUser syslog
$PrivDropToGroup syslog
you may try skipping the privdrop stuff, this is an area that rsyslog does
not do especially well with. it may or may not cause this problem, but
it's worth trying without it.
David Lang
# RELP
$ModLoad imrelp
$InputRELPServerRun 600
$MainMsgQueueSize 100000
... followed by a lot of splitting with dynamic filenames like this:
$template SplitServiceRsyncLog,"/srv/log/system/%hostname%/%$now%/rsyncd.log"
if $hostname == 'node6' and $syslogfacility == 16 then -?SplitServiceRsyncLog
& ~
if $hostname == 'node7' and $syslogfacility == 16 then -?SplitServiceRsyncLog
& ~
if $hostname == 'build' and $syslogfacility == 16 then -?SplitServiceRsyncLog
& ~
The bottom line is that we need to actually see what rsyslog is doing. If you
version is not too old, we could use debug on demand (in the link, Florian
says he tested it with 6.x, but left out the more interesting fact of which
is the minimum version ;)):
http://www.rsyslog.com/how-to-use-debug-on-demand/
I'm using 5.6.0.
Thanks,
John
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
