sorry for the bump we had just upgraded to 5.6.2 and it is still happening this is now happening almost hourly and not at the same time as file rotation we will try catching it while in debug mode tomorrow morning any other ideas on the subject for now?
On Wed, Nov 10, 2010 at 7:47 PM, Rainer Gerhards <[email protected]>wrote: > Could you run it in debug mode and provide me a log covering a situation > where the problem occurs? I may be able to gain some information from that. > > Rainer > > > -----Original Message----- > > From: [email protected] [mailto:rsyslog- > > [email protected]] On Behalf Of matan monitz > > Sent: Wednesday, November 10, 2010 6:46 PM > > To: rsyslog-users > > Subject: Re: [rsyslog] rsyslog Text File Input Module losing seek? > > > > hello rainer > > unfortunately we will not be able to apply a fix if provided, > > if an upgrade will eventually happen it will likely be to Version 5. > > > > i have reviewed the references you provided and i don't believe they > > are > > relevant to our case > > out files rotate at 10MB which is miles off from 2GB. > > also, as i mentioned,i think this is not related to state files because > > we > > made sure they are being created and that rsyslog is not crashing > > i agree there is not much point in providing a fix at this point, > > however i > > would like to hear any other guesses you may have regarding the cause > > of the > > situation so that i may figure out a way to work around it outside of > > rsyslog > > also i will be happy to provide technical data and logs as instructed > > if you > > need another test case > > > > thanks in advance > > > > > > > > > > On Wed, Nov 10, 2010 at 11:39 AM, Rainer Gerhards > > <[email protected]>wrote: > > > > > > -----Original Message----- > > > > From: [email protected] [mailto:rsyslog- > > > > [email protected]] On Behalf Of matan monitz > > > > Sent: Monday, November 08, 2010 7:08 PM > > > > To: rsyslog-users > > > > Subject: Re: [rsyslog] rsyslog Text File Input Module losing seek? > > > > > > > > hi rainer > > > > unfortunately this is not a server i'm directly in charge of so we > > > > can't > > > > really upgrade for while > > > > (they will only upgrade as part of the planned upgrade for the > > whole > > > > server) > > > > > > Does that also mean you would not be able to apply a fix if I I > > provide one > > > for 3.22.2 (the current v3-stable)? > > > > > > > can you please elaborate on the cause of the problem so that maybe > > i > > > > can > > > > figure out a temporary workaround? > > > > > > There definitely is a problem when the file size is larger than 2GB. > > The > > > rest > > > may be related to dirty shutdown when the state file is deleted. See > > > > > > > > > > > http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=40814bb0307f9d8536 > > b3dc4a > > > > > 28b94f80a361b41d<http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=4 > > 0814bb0307f9d8536b3dc4a%0A28b94f80a361b41d> > > > > > > > > > > > http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=90933057bc2f014fd2 > > 124ba7 > > > > > d830652e9b1ead96<http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=9 > > 0933057bc2f014fd2124ba7%0Ad830652e9b1ead96> > > > > > > I have not yet receive feedback that makes me sure it's 100% fixed, > > so I'd > > > actually be quite interested in another test case. However, quite > > honestly, > > > if we can't run a better version on your box, there is no point for > > me in > > > further looking at that case (because it can't be solved anyway...). > > > > > > Rainer > > > > > > > On Mon, Nov 8, 2010 at 6:39 PM, Rainer Gerhards > > > > <[email protected]>wrote: > > > > > > > > > > -----Original Message----- > > > > > > From: [email protected] [mailto:rsyslog- > > > > > > [email protected]] On Behalf Of matan monitz > > > > > > Sent: Monday, November 08, 2010 3:51 PM > > > > > > To: rsyslog-users > > > > > > Subject: Re: [rsyslog] rsyslog Text File Input Module losing > > seek? > > > > > > > > > > > > hello rainer > > > > > > we are using 3.22.1-3 from rpm on rhel 5 > > > > > > > > > > That's definitely too old. I maintain it when I am at it, but the > > fix > > > > went > > > > > into v4+ so far. I suggest that you pull the latest v4-stable > > from > > > > git. If > > > > > git doesn't work for you, let me know and I'll mail you a private > > > > tarball. > > > > > I > > > > > am just right now very busy (probably tomorrow as well, as I am > > > > writing a > > > > > lot > > > > > of new code in support for CEE). > > > > > > > > > > Rainer > > > > > > > > > > > > > > > > > On Mon, Nov 8, 2010 at 3:46 PM, Rainer Gerhards > > > > > > <[email protected]>wrote: > > > > > > > > > > > > > which version do you use? I have recently addressed such a > > > > problem... > > > > > > > > > > > > > > Rainer > > > > > > > > > > > > > > > -----Original Message----- > > > > > > > > From: [email protected] [mailto:rsyslog- > > > > > > > > [email protected]] On Behalf Of matan monitz > > > > > > > > Sent: Monday, November 08, 2010 2:45 PM > > > > > > > > To: [email protected] > > > > > > > > Subject: [rsyslog] rsyslog Text File Input Module losing > > seek? > > > > > > > > > > > > > > > > Hello all > > > > > > > > we have a bind server writing and rotating logs on file > > system > > > > > > > > (rotating > > > > > > > > when log file reaches 10Mb). > > > > > > > > we also have rsyslog configured with the text file input > > module > > > > > > reading > > > > > > > > the > > > > > > > > file and sending it over UDP to another rsyslog server. > > > > > > > > several times during the day the rsyslog on the bind > > machine > > > > starts > > > > > > > > reading > > > > > > > > the file from the top, causing a sudden high rate of > > duplicate > > > > and > > > > > > old > > > > > > > > events. > > > > > > > > in an attempt to identify the problem: > > > > > > > > 1.verified this using tcpdump to make sure the and saw the > > old > > > > logs > > > > > > > > coming > > > > > > > > down the wire to the rsyslog server > > > > > > > > 2.made sure state files are correctly configured and are > > being > > > > > > created > > > > > > > > when > > > > > > > > needed > > > > > > > > 3.made sure the rsyslog is not crashing and restarting by > > > > > > monitoring > > > > > > > > the pid > > > > > > > > googeling hasn't helped as well > > > > > > > > > > > > > > > > any ideas? > > > > > > > > _______________________________________________ > > > > > > > > rsyslog mailing list > > > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > > > http://www.rsyslog.com > > > > > > > _______________________________________________ > > > > > > > rsyslog mailing list > > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > > http://www.rsyslog.com > > > > > > > > > > > > > _______________________________________________ > > > > > > rsyslog mailing list > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > http://www.rsyslog.com > > > > > _______________________________________________ > > > > > rsyslog mailing list > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > http://www.rsyslog.com > > > > > > > > > _______________________________________________ > > > > rsyslog mailing list > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > http://www.rsyslog.com > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com > > > > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
