W dniu 17.11.2010 13:47, Rainer Gerhards pisze: > Unfortunately there is no tool yet to recover from such a situation. If the
Is this near future or distant future? > log data is important enough, you need to manually clean up the control > structures, which is probably quite a bit of work. The part that zeroed out > is lost in any case. Probably the best idea is to remove the zeroed-out part > and delete everything up to the next object header (check obj.c or so for > details). Then adjust the input part of the qi file to a zero offset. As long > as the ouput is not malformed, that should require no action. I don't know why so big part of file is zeroed ba replaying journal? There is quite small traffic, something about ~5 msg/sec, it doesn't need so much space. I would expect that zeroed should has size ~ one-three * blocksize. Could be related to way rsyslog opens file? probably last question, why after crash, always first file from queue is corrupted, not last, which is open while resyslog works? Does rsyslog write not only to last file and .qi but to diffrent files? Thanks a lot. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
