hello rainer unfortunately we will not be able to apply a fix if provided, if an upgrade will eventually happen it will likely be to Version 5.
i have reviewed the references you provided and i don't believe they are relevant to our case out files rotate at 10MB which is miles off from 2GB. also, as i mentioned,i think this is not related to state files because we made sure they are being created and that rsyslog is not crashing i agree there is not much point in providing a fix at this point, however i would like to hear any other guesses you may have regarding the cause of the situation so that i may figure out a way to work around it outside of rsyslog also i will be happy to provide technical data and logs as instructed if you need another test case thanks in advance On Wed, Nov 10, 2010 at 11:39 AM, Rainer Gerhards <[email protected]>wrote: > > -----Original Message----- > > From: [email protected] [mailto:rsyslog- > > [email protected]] On Behalf Of matan monitz > > Sent: Monday, November 08, 2010 7:08 PM > > To: rsyslog-users > > Subject: Re: [rsyslog] rsyslog Text File Input Module losing seek? > > > > hi rainer > > unfortunately this is not a server i'm directly in charge of so we > > can't > > really upgrade for while > > (they will only upgrade as part of the planned upgrade for the whole > > server) > > Does that also mean you would not be able to apply a fix if I I provide one > for 3.22.2 (the current v3-stable)? > > > can you please elaborate on the cause of the problem so that maybe i > > can > > figure out a temporary workaround? > > There definitely is a problem when the file size is larger than 2GB. The > rest > may be related to dirty shutdown when the state file is deleted. See > > > http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=40814bb0307f9d8536b3dc4a > 28b94f80a361b41d<http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=40814bb0307f9d8536b3dc4a%0A28b94f80a361b41d> > > > http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=90933057bc2f014fd2124ba7 > d830652e9b1ead96<http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=90933057bc2f014fd2124ba7%0Ad830652e9b1ead96> > > I have not yet receive feedback that makes me sure it's 100% fixed, so I'd > actually be quite interested in another test case. However, quite honestly, > if we can't run a better version on your box, there is no point for me in > further looking at that case (because it can't be solved anyway...). > > Rainer > > > On Mon, Nov 8, 2010 at 6:39 PM, Rainer Gerhards > > <[email protected]>wrote: > > > > > > -----Original Message----- > > > > From: [email protected] [mailto:rsyslog- > > > > [email protected]] On Behalf Of matan monitz > > > > Sent: Monday, November 08, 2010 3:51 PM > > > > To: rsyslog-users > > > > Subject: Re: [rsyslog] rsyslog Text File Input Module losing seek? > > > > > > > > hello rainer > > > > we are using 3.22.1-3 from rpm on rhel 5 > > > > > > That's definitely too old. I maintain it when I am at it, but the fix > > went > > > into v4+ so far. I suggest that you pull the latest v4-stable from > > git. If > > > git doesn't work for you, let me know and I'll mail you a private > > tarball. > > > I > > > am just right now very busy (probably tomorrow as well, as I am > > writing a > > > lot > > > of new code in support for CEE). > > > > > > Rainer > > > > > > > > > > > On Mon, Nov 8, 2010 at 3:46 PM, Rainer Gerhards > > > > <[email protected]>wrote: > > > > > > > > > which version do you use? I have recently addressed such a > > problem... > > > > > > > > > > Rainer > > > > > > > > > > > -----Original Message----- > > > > > > From: [email protected] [mailto:rsyslog- > > > > > > [email protected]] On Behalf Of matan monitz > > > > > > Sent: Monday, November 08, 2010 2:45 PM > > > > > > To: [email protected] > > > > > > Subject: [rsyslog] rsyslog Text File Input Module losing seek? > > > > > > > > > > > > Hello all > > > > > > we have a bind server writing and rotating logs on file system > > > > > > (rotating > > > > > > when log file reaches 10Mb). > > > > > > we also have rsyslog configured with the text file input module > > > > reading > > > > > > the > > > > > > file and sending it over UDP to another rsyslog server. > > > > > > several times during the day the rsyslog on the bind machine > > starts > > > > > > reading > > > > > > the file from the top, causing a sudden high rate of duplicate > > and > > > > old > > > > > > events. > > > > > > in an attempt to identify the problem: > > > > > > 1.verified this using tcpdump to make sure the and saw the old > > logs > > > > > > coming > > > > > > down the wire to the rsyslog server > > > > > > 2.made sure state files are correctly configured and are being > > > > created > > > > > > when > > > > > > needed > > > > > > 3.made sure the rsyslog is not crashing and restarting by > > > > monitoring > > > > > > the pid > > > > > > googeling hasn't helped as well > > > > > > > > > > > > any ideas? > > > > > > _______________________________________________ > > > > > > rsyslog mailing list > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > http://www.rsyslog.com > > > > > _______________________________________________ > > > > > rsyslog mailing list > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > http://www.rsyslog.com > > > > > > > > > _______________________________________________ > > > > rsyslog mailing list > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > http://www.rsyslog.com > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com > > > > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
