> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Marcin Miroslaw > Sent: Wednesday, November 17, 2010 6:55 PM > To: [email protected] > Subject: Re: [rsyslog] dealing with broken spool > > W dniu 2010-11-17 18:43, Rainer Gerhards pisze: > >> Exactly, i wrote earlier: > >> "Rsyslog was looking for dbq.00000097 (this was writtent in dbq.qi), > I > >> touched dbq.00000097 and all queue was relayed to the next rsyslog. > >> " > > quite honestly, I did not get the meaning of that sentence > > Previously, i thought that problem is in file dbq.00000098, which was > zeroed in half. When i run rsyslog with debug, i saw that rsyslog was > looking for file dbq.00000097. I executed: "touch dbq.00000097", rerun > rsylogd. Next rsyslog was happy, because has all needed files and > relayed all messages to the next host. Recently i've discovered value > "+DeleteOnClose" in dbq.qi , and i'm wondering if is it possible that > file dbq.00000097 was unlinked when system became unstable (out of > memory).
Ah, ok, so you actually mean touch, as in create file. Makes sense. Yes, that could be and typically is the case. Rsyslog works on the assumption that the queue file is only persisted after the specified interval, and it may unlink a file without updating the queue file. Obviously, this could be improved, but requires more work than seems obvious (because all of this happens at different layers of the stack - still a good idea...). Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
