> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Marcin Miroslaw > Sent: Wednesday, November 17, 2010 2:34 PM > To: [email protected] > Subject: Re: [rsyslog] dealing with broken spool > > W dniu 17.11.2010 13:47, Rainer Gerhards pisze: > > Unfortunately there is no tool yet to recover from such a situation. > If the > > Is this near future or distant future?
distant, I probably need a sponsor to do that to the current code base. In the medium term, I'll re-write the disk queue subsystem, because it has outgrown its initial requirements base. It can be done much better (including recovery). > > > log data is important enough, you need to manually clean up the > control > > structures, which is probably quite a bit of work. The part that > zeroed out > > is lost in any case. Probably the best idea is to remove the zeroed- > out part > > and delete everything up to the next object header (check obj.c or so > for > > details). Then adjust the input part of the qi file to a zero offset. > As long > > as the ouput is not malformed, that should require no action. > > I don't know why so big part of file is zeroed ba replaying journal? I don't know either, rsyslog writes pure text data to the queue files (one thing to be changed in the new subsystem), so I know for sure rsyslog does not write zeros. > There is quite small traffic, something about ~5 msg/sec, it doesn't > need so much space. I would expect that zeroed should has size ~ > one-three * blocksize. Could be related to way rsyslog opens file? > probably last question, why after crash, always first file from queue > is > corrupted, not last, which is open while resyslog works? Does rsyslog > write not only to last file and .qi but to diffrent files? It writes to the .qi and the last (highest numbered) file. non-highest numbered files are only read. Rainer > Thanks a lot. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
