I guess I need to merge and release a new v5-stable. Fixes are already in git, but as it seems I missed v5-stable (-devel and all others have it).
Rainer > -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of matan monitz > Sent: Tuesday, January 25, 2011 4:18 PM > To: rsyslog-users > Subject: Re: [rsyslog] rsyslog Text File Input Module losing seek? > > sorry for the bump > we had just upgraded to 5.6.2 and it is still happening > this is now happening almost hourly and not at the same time as file > rotation > we will try catching it while in debug mode tomorrow morning > any other ideas on the subject for now? > > On Wed, Nov 10, 2010 at 7:47 PM, Rainer Gerhards > <[email protected]>wrote: > > > Could you run it in debug mode and provide me a log covering a > situation > > where the problem occurs? I may be able to gain some information from > that. > > > > Rainer > > > > > -----Original Message----- > > > From: [email protected] [mailto:rsyslog- > > > [email protected]] On Behalf Of matan monitz > > > Sent: Wednesday, November 10, 2010 6:46 PM > > > To: rsyslog-users > > > Subject: Re: [rsyslog] rsyslog Text File Input Module losing seek? > > > > > > hello rainer > > > unfortunately we will not be able to apply a fix if provided, > > > if an upgrade will eventually happen it will likely be to Version > 5. > > > > > > i have reviewed the references you provided and i don't believe > they > > > are > > > relevant to our case > > > out files rotate at 10MB which is miles off from 2GB. > > > also, as i mentioned,i think this is not related to state files > because > > > we > > > made sure they are being created and that rsyslog is not crashing > > > i agree there is not much point in providing a fix at this point, > > > however i > > > would like to hear any other guesses you may have regarding the > cause > > > of the > > > situation so that i may figure out a way to work around it outside > of > > > rsyslog > > > also i will be happy to provide technical data and logs as > instructed > > > if you > > > need another test case > > > > > > thanks in advance > > > > > > > > > > > > > > > On Wed, Nov 10, 2010 at 11:39 AM, Rainer Gerhards > > > <[email protected]>wrote: > > > > > > > > -----Original Message----- > > > > > From: [email protected] [mailto:rsyslog- > > > > > [email protected]] On Behalf Of matan monitz > > > > > Sent: Monday, November 08, 2010 7:08 PM > > > > > To: rsyslog-users > > > > > Subject: Re: [rsyslog] rsyslog Text File Input Module losing > seek? > > > > > > > > > > hi rainer > > > > > unfortunately this is not a server i'm directly in charge of so > we > > > > > can't > > > > > really upgrade for while > > > > > (they will only upgrade as part of the planned upgrade for the > > > whole > > > > > server) > > > > > > > > Does that also mean you would not be able to apply a fix if I I > > > provide one > > > > for 3.22.2 (the current v3-stable)? > > > > > > > > > can you please elaborate on the cause of the problem so that > maybe > > > i > > > > > can > > > > > figure out a temporary workaround? > > > > > > > > There definitely is a problem when the file size is larger than > 2GB. > > > The > > > > rest > > > > may be related to dirty shutdown when the state file is deleted. > See > > > > > > > > > > > > > > > > http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=40814bb0307f9d8536 > > > b3dc4a > > > > > > > > 28b94f80a361b41d<http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=4 > > > 0814bb0307f9d8536b3dc4a%0A28b94f80a361b41d> > > > > > > > > > > > > > > > > http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=90933057bc2f014fd2 > > > 124ba7 > > > > > > > > d830652e9b1ead96<http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=9 > > > 0933057bc2f014fd2124ba7%0Ad830652e9b1ead96> > > > > > > > > I have not yet receive feedback that makes me sure it's 100% > fixed, > > > so I'd > > > > actually be quite interested in another test case. However, quite > > > honestly, > > > > if we can't run a better version on your box, there is no point > for > > > me in > > > > further looking at that case (because it can't be solved > anyway...). > > > > > > > > Rainer > > > > > > > > > On Mon, Nov 8, 2010 at 6:39 PM, Rainer Gerhards > > > > > <[email protected]>wrote: > > > > > > > > > > > > -----Original Message----- > > > > > > > From: [email protected] [mailto:rsyslog- > > > > > > > [email protected]] On Behalf Of matan monitz > > > > > > > Sent: Monday, November 08, 2010 3:51 PM > > > > > > > To: rsyslog-users > > > > > > > Subject: Re: [rsyslog] rsyslog Text File Input Module > losing > > > seek? > > > > > > > > > > > > > > hello rainer > > > > > > > we are using 3.22.1-3 from rpm on rhel 5 > > > > > > > > > > > > That's definitely too old. I maintain it when I am at it, but > the > > > fix > > > > > went > > > > > > into v4+ so far. I suggest that you pull the latest v4-stable > > > from > > > > > git. If > > > > > > git doesn't work for you, let me know and I'll mail you a > private > > > > > tarball. > > > > > > I > > > > > > am just right now very busy (probably tomorrow as well, as I > am > > > > > writing a > > > > > > lot > > > > > > of new code in support for CEE). > > > > > > > > > > > > Rainer > > > > > > > > > > > > > > > > > > > > On Mon, Nov 8, 2010 at 3:46 PM, Rainer Gerhards > > > > > > > <[email protected]>wrote: > > > > > > > > > > > > > > > which version do you use? I have recently addressed such > a > > > > > problem... > > > > > > > > > > > > > > > > Rainer > > > > > > > > > > > > > > > > > -----Original Message----- > > > > > > > > > From: [email protected] > [mailto:rsyslog- > > > > > > > > > [email protected]] On Behalf Of matan monitz > > > > > > > > > Sent: Monday, November 08, 2010 2:45 PM > > > > > > > > > To: [email protected] > > > > > > > > > Subject: [rsyslog] rsyslog Text File Input Module > losing > > > seek? > > > > > > > > > > > > > > > > > > Hello all > > > > > > > > > we have a bind server writing and rotating logs on file > > > system > > > > > > > > > (rotating > > > > > > > > > when log file reaches 10Mb). > > > > > > > > > we also have rsyslog configured with the text file > input > > > module > > > > > > > reading > > > > > > > > > the > > > > > > > > > file and sending it over UDP to another rsyslog server. > > > > > > > > > several times during the day the rsyslog on the bind > > > machine > > > > > starts > > > > > > > > > reading > > > > > > > > > the file from the top, causing a sudden high rate of > > > duplicate > > > > > and > > > > > > > old > > > > > > > > > events. > > > > > > > > > in an attempt to identify the problem: > > > > > > > > > 1.verified this using tcpdump to make sure the and saw > the > > > old > > > > > logs > > > > > > > > > coming > > > > > > > > > down the wire to the rsyslog server > > > > > > > > > 2.made sure state files are correctly configured and > are > > > being > > > > > > > created > > > > > > > > > when > > > > > > > > > needed > > > > > > > > > 3.made sure the rsyslog is not crashing and restarting > by > > > > > > > monitoring > > > > > > > > > the pid > > > > > > > > > googeling hasn't helped as well > > > > > > > > > > > > > > > > > > any ideas? > > > > > > > > > _______________________________________________ > > > > > > > > > rsyslog mailing list > > > > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > > > > http://www.rsyslog.com > > > > > > > > _______________________________________________ > > > > > > > > rsyslog mailing list > > > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > > > http://www.rsyslog.com > > > > > > > > > > > > > > > _______________________________________________ > > > > > > > rsyslog mailing list > > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > > http://www.rsyslog.com > > > > > > _______________________________________________ > > > > > > rsyslog mailing list > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > http://www.rsyslog.com > > > > > > > > > > > _______________________________________________ > > > > > rsyslog mailing list > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > http://www.rsyslog.com > > > > _______________________________________________ > > > > rsyslog mailing list > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > http://www.rsyslog.com > > > > > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
