> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of matan monitz > Sent: Monday, November 08, 2010 7:08 PM > To: rsyslog-users > Subject: Re: [rsyslog] rsyslog Text File Input Module losing seek? > > hi rainer > unfortunately this is not a server i'm directly in charge of so we > can't > really upgrade for while > (they will only upgrade as part of the planned upgrade for the whole > server)
Does that also mean you would not be able to apply a fix if I I provide one for 3.22.2 (the current v3-stable)? > can you please elaborate on the cause of the problem so that maybe i > can > figure out a temporary workaround? There definitely is a problem when the file size is larger than 2GB. The rest may be related to dirty shutdown when the state file is deleted. See http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=40814bb0307f9d8536b3dc4a 28b94f80a361b41d http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=90933057bc2f014fd2124ba7 d830652e9b1ead96 I have not yet receive feedback that makes me sure it's 100% fixed, so I'd actually be quite interested in another test case. However, quite honestly, if we can't run a better version on your box, there is no point for me in further looking at that case (because it can't be solved anyway...). Rainer > On Mon, Nov 8, 2010 at 6:39 PM, Rainer Gerhards > <[email protected]>wrote: > > > > -----Original Message----- > > > From: [email protected] [mailto:rsyslog- > > > [email protected]] On Behalf Of matan monitz > > > Sent: Monday, November 08, 2010 3:51 PM > > > To: rsyslog-users > > > Subject: Re: [rsyslog] rsyslog Text File Input Module losing seek? > > > > > > hello rainer > > > we are using 3.22.1-3 from rpm on rhel 5 > > > > That's definitely too old. I maintain it when I am at it, but the fix > went > > into v4+ so far. I suggest that you pull the latest v4-stable from > git. If > > git doesn't work for you, let me know and I'll mail you a private > tarball. > > I > > am just right now very busy (probably tomorrow as well, as I am > writing a > > lot > > of new code in support for CEE). > > > > Rainer > > > > > > > > On Mon, Nov 8, 2010 at 3:46 PM, Rainer Gerhards > > > <[email protected]>wrote: > > > > > > > which version do you use? I have recently addressed such a > problem... > > > > > > > > Rainer > > > > > > > > > -----Original Message----- > > > > > From: [email protected] [mailto:rsyslog- > > > > > [email protected]] On Behalf Of matan monitz > > > > > Sent: Monday, November 08, 2010 2:45 PM > > > > > To: [email protected] > > > > > Subject: [rsyslog] rsyslog Text File Input Module losing seek? > > > > > > > > > > Hello all > > > > > we have a bind server writing and rotating logs on file system > > > > > (rotating > > > > > when log file reaches 10Mb). > > > > > we also have rsyslog configured with the text file input module > > > reading > > > > > the > > > > > file and sending it over UDP to another rsyslog server. > > > > > several times during the day the rsyslog on the bind machine > starts > > > > > reading > > > > > the file from the top, causing a sudden high rate of duplicate > and > > > old > > > > > events. > > > > > in an attempt to identify the problem: > > > > > 1.verified this using tcpdump to make sure the and saw the old > logs > > > > > coming > > > > > down the wire to the rsyslog server > > > > > 2.made sure state files are correctly configured and are being > > > created > > > > > when > > > > > needed > > > > > 3.made sure the rsyslog is not crashing and restarting by > > > monitoring > > > > > the pid > > > > > googeling hasn't helped as well > > > > > > > > > > any ideas? > > > > > _______________________________________________ > > > > > rsyslog mailing list > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > http://www.rsyslog.com > > > > _______________________________________________ > > > > rsyslog mailing list > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > http://www.rsyslog.com > > > > > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
