> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Marcin Miroslaw > Sent: Wednesday, November 17, 2010 1:21 PM > To: rsyslog-users > Subject: [rsyslog] dealing with broken spool > > Hello! > Yesterday my box crashed then i started to have problem with > spool/workdirectory. It's defined in this way: > $WorkDirectory /var/spool/rsyslog > $ActionQueueType LinkedList > $ActionQueueFileName dbq > $ActionResumeRetryCount -1 > $MainMsgQueueMaxFileSize 512M > $MainMsgQueueSaveOnShutdown on > > At the moment of crash, there were a few files dbq.00000xxxx . In first > file, with lowest number (dbq.00000098), appears zeroes form start of > file to position #001000F8 (after reboot). I'm wondering why so much > file is zeroed? Is it theme of filesystem? (its ext4, mount options: > barrier=1,data=ordered) or don't know, rsyslog keeps open file too > long?
rsyslog does not write zeros. > Next question is what can i do it with broken file? > - probably i should delete zeroed part of file and modify dbq.qi? > - how many messages could be lost? > - is it possible for rsyslog to skip broken part of file? Unfortunately there is no tool yet to recover from such a situation. If the log data is important enough, you need to manually clean up the control structures, which is probably quite a bit of work. The part that zeroed out is lost in any case. Probably the best idea is to remove the zeroed-out part and delete everything up to the next object header (check obj.c or so for details). Then adjust the input part of the qi file to a zero offset. As long as the ouput is not malformed, that should require no action. Rainer > > # rsyslogd -v > rsyslogd 6.1.1, compiled with: > FEATURE_REGEXP: Yes > FEATURE_LARGEFILE: Yes > FEATURE_NETZIP (message compression): Yes > GSSAPI Kerberos 5 support: No > FEATURE_DEBUG (debug build, slow code): No > Atomic operations supported: Yes > Runtime Instrumentation (slow code): No > > git version: 950fe206f84322bdff755988403a9d4017ec26f4 > Host is on xen, paravirtualization. > Regards! > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
