Could you run it in debug mode and provide me a log covering a situation where the problem occurs? I may be able to gain some information from that.
Rainer > -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of matan monitz > Sent: Wednesday, November 10, 2010 6:46 PM > To: rsyslog-users > Subject: Re: [rsyslog] rsyslog Text File Input Module losing seek? > > hello rainer > unfortunately we will not be able to apply a fix if provided, > if an upgrade will eventually happen it will likely be to Version 5. > > i have reviewed the references you provided and i don't believe they > are > relevant to our case > out files rotate at 10MB which is miles off from 2GB. > also, as i mentioned,i think this is not related to state files because > we > made sure they are being created and that rsyslog is not crashing > i agree there is not much point in providing a fix at this point, > however i > would like to hear any other guesses you may have regarding the cause > of the > situation so that i may figure out a way to work around it outside of > rsyslog > also i will be happy to provide technical data and logs as instructed > if you > need another test case > > thanks in advance > > > > > On Wed, Nov 10, 2010 at 11:39 AM, Rainer Gerhards > <[email protected]>wrote: > > > > -----Original Message----- > > > From: [email protected] [mailto:rsyslog- > > > [email protected]] On Behalf Of matan monitz > > > Sent: Monday, November 08, 2010 7:08 PM > > > To: rsyslog-users > > > Subject: Re: [rsyslog] rsyslog Text File Input Module losing seek? > > > > > > hi rainer > > > unfortunately this is not a server i'm directly in charge of so we > > > can't > > > really upgrade for while > > > (they will only upgrade as part of the planned upgrade for the > whole > > > server) > > > > Does that also mean you would not be able to apply a fix if I I > provide one > > for 3.22.2 (the current v3-stable)? > > > > > can you please elaborate on the cause of the problem so that maybe > i > > > can > > > figure out a temporary workaround? > > > > There definitely is a problem when the file size is larger than 2GB. > The > > rest > > may be related to dirty shutdown when the state file is deleted. See > > > > > > > http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=40814bb0307f9d8536 > b3dc4a > > > 28b94f80a361b41d<http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=4 > 0814bb0307f9d8536b3dc4a%0A28b94f80a361b41d> > > > > > > > http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=90933057bc2f014fd2 > 124ba7 > > > d830652e9b1ead96<http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=9 > 0933057bc2f014fd2124ba7%0Ad830652e9b1ead96> > > > > I have not yet receive feedback that makes me sure it's 100% fixed, > so I'd > > actually be quite interested in another test case. However, quite > honestly, > > if we can't run a better version on your box, there is no point for > me in > > further looking at that case (because it can't be solved anyway...). > > > > Rainer > > > > > On Mon, Nov 8, 2010 at 6:39 PM, Rainer Gerhards > > > <[email protected]>wrote: > > > > > > > > -----Original Message----- > > > > > From: [email protected] [mailto:rsyslog- > > > > > [email protected]] On Behalf Of matan monitz > > > > > Sent: Monday, November 08, 2010 3:51 PM > > > > > To: rsyslog-users > > > > > Subject: Re: [rsyslog] rsyslog Text File Input Module losing > seek? > > > > > > > > > > hello rainer > > > > > we are using 3.22.1-3 from rpm on rhel 5 > > > > > > > > That's definitely too old. I maintain it when I am at it, but the > fix > > > went > > > > into v4+ so far. I suggest that you pull the latest v4-stable > from > > > git. If > > > > git doesn't work for you, let me know and I'll mail you a private > > > tarball. > > > > I > > > > am just right now very busy (probably tomorrow as well, as I am > > > writing a > > > > lot > > > > of new code in support for CEE). > > > > > > > > Rainer > > > > > > > > > > > > > > On Mon, Nov 8, 2010 at 3:46 PM, Rainer Gerhards > > > > > <[email protected]>wrote: > > > > > > > > > > > which version do you use? I have recently addressed such a > > > problem... > > > > > > > > > > > > Rainer > > > > > > > > > > > > > -----Original Message----- > > > > > > > From: [email protected] [mailto:rsyslog- > > > > > > > [email protected]] On Behalf Of matan monitz > > > > > > > Sent: Monday, November 08, 2010 2:45 PM > > > > > > > To: [email protected] > > > > > > > Subject: [rsyslog] rsyslog Text File Input Module losing > seek? > > > > > > > > > > > > > > Hello all > > > > > > > we have a bind server writing and rotating logs on file > system > > > > > > > (rotating > > > > > > > when log file reaches 10Mb). > > > > > > > we also have rsyslog configured with the text file input > module > > > > > reading > > > > > > > the > > > > > > > file and sending it over UDP to another rsyslog server. > > > > > > > several times during the day the rsyslog on the bind > machine > > > starts > > > > > > > reading > > > > > > > the file from the top, causing a sudden high rate of > duplicate > > > and > > > > > old > > > > > > > events. > > > > > > > in an attempt to identify the problem: > > > > > > > 1.verified this using tcpdump to make sure the and saw the > old > > > logs > > > > > > > coming > > > > > > > down the wire to the rsyslog server > > > > > > > 2.made sure state files are correctly configured and are > being > > > > > created > > > > > > > when > > > > > > > needed > > > > > > > 3.made sure the rsyslog is not crashing and restarting by > > > > > monitoring > > > > > > > the pid > > > > > > > googeling hasn't helped as well > > > > > > > > > > > > > > any ideas? > > > > > > > _______________________________________________ > > > > > > > rsyslog mailing list > > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > > http://www.rsyslog.com > > > > > > _______________________________________________ > > > > > > rsyslog mailing list > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > http://www.rsyslog.com > > > > > > > > > > > _______________________________________________ > > > > > rsyslog mailing list > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > http://www.rsyslog.com > > > > _______________________________________________ > > > > rsyslog mailing list > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > http://www.rsyslog.com > > > > > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
