> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of matan monitz > Sent: Wednesday, January 26, 2011 1:45 PM > To: rsyslog-users > Subject: Re: [rsyslog] rsyslog Text File Input Module losing seek? > > hi Rainer > is this a known issue? i could not find it documented anywhere
yes it is -- probably it was never submitted via bugzilla or some other persistent ressource. I get lot's of report "on the fly" and have given up try to document them all. But the changelog is complete. I have a new 5.6.3 ready for release, but the web server has some problems (being worked on). I'll see that I mail you a copy. Rainer > > On Tue, Jan 25, 2011 at 7:28 PM, Rainer Gerhards > <[email protected]>wrote: > > > I guess I need to merge and release a new v5-stable. Fixes are > already in > > git, but as it seems I missed v5-stable (-devel and all others have > it). > > > > Rainer > > > > > -----Original Message----- > > > From: [email protected] [mailto:rsyslog- > > > [email protected]] On Behalf Of matan monitz > > > Sent: Tuesday, January 25, 2011 4:18 PM > > > To: rsyslog-users > > > Subject: Re: [rsyslog] rsyslog Text File Input Module losing seek? > > > > > > sorry for the bump > > > we had just upgraded to 5.6.2 and it is still happening > > > this is now happening almost hourly and not at the same time as > file > > > rotation > > > we will try catching it while in debug mode tomorrow morning > > > any other ideas on the subject for now? > > > > > > On Wed, Nov 10, 2010 at 7:47 PM, Rainer Gerhards > > > <[email protected]>wrote: > > > > > > > Could you run it in debug mode and provide me a log covering a > > > situation > > > > where the problem occurs? I may be able to gain some information > from > > > that. > > > > > > > > Rainer > > > > > > > > > -----Original Message----- > > > > > From: [email protected] [mailto:rsyslog- > > > > > [email protected]] On Behalf Of matan monitz > > > > > Sent: Wednesday, November 10, 2010 6:46 PM > > > > > To: rsyslog-users > > > > > Subject: Re: [rsyslog] rsyslog Text File Input Module losing > seek? > > > > > > > > > > hello rainer > > > > > unfortunately we will not be able to apply a fix if provided, > > > > > if an upgrade will eventually happen it will likely be to > Version > > > 5. > > > > > > > > > > i have reviewed the references you provided and i don't believe > > > they > > > > > are > > > > > relevant to our case > > > > > out files rotate at 10MB which is miles off from 2GB. > > > > > also, as i mentioned,i think this is not related to state files > > > because > > > > > we > > > > > made sure they are being created and that rsyslog is not > crashing > > > > > i agree there is not much point in providing a fix at this > point, > > > > > however i > > > > > would like to hear any other guesses you may have regarding the > > > cause > > > > > of the > > > > > situation so that i may figure out a way to work around it > outside > > > of > > > > > rsyslog > > > > > also i will be happy to provide technical data and logs as > > > instructed > > > > > if you > > > > > need another test case > > > > > > > > > > thanks in advance > > > > > > > > > > > > > > > > > > > > > > > > > On Wed, Nov 10, 2010 at 11:39 AM, Rainer Gerhards > > > > > <[email protected]>wrote: > > > > > > > > > > > > -----Original Message----- > > > > > > > From: [email protected] [mailto:rsyslog- > > > > > > > [email protected]] On Behalf Of matan monitz > > > > > > > Sent: Monday, November 08, 2010 7:08 PM > > > > > > > To: rsyslog-users > > > > > > > Subject: Re: [rsyslog] rsyslog Text File Input Module > losing > > > seek? > > > > > > > > > > > > > > hi rainer > > > > > > > unfortunately this is not a server i'm directly in charge > of so > > > we > > > > > > > can't > > > > > > > really upgrade for while > > > > > > > (they will only upgrade as part of the planned upgrade for > the > > > > > whole > > > > > > > server) > > > > > > > > > > > > Does that also mean you would not be able to apply a fix if I > I > > > > > provide one > > > > > > for 3.22.2 (the current v3-stable)? > > > > > > > > > > > > > can you please elaborate on the cause of the problem so > that > > > maybe > > > > > i > > > > > > > can > > > > > > > figure out a temporary workaround? > > > > > > > > > > > > There definitely is a problem when the file size is larger > than > > > 2GB. > > > > > The > > > > > > rest > > > > > > may be related to dirty shutdown when the state file is > deleted. > > > See > > > > > > > > > > > > > > > > > > > > > > > > > > > http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=40814bb0307f9d8536 > > > > > b3dc4a > > > > > > > > > > > > > > > 28b94f80a361b41d<http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=4 > > > > > 0814bb0307f9d8536b3dc4a%0A28b94f80a361b41d> > > > > > > > > > > > > > > > > > > > > > > > > > > > http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=90933057bc2f014fd2 > > > > > 124ba7 > > > > > > > > > > > > > > > d830652e9b1ead96<http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=9 > > > > > 0933057bc2f014fd2124ba7%0Ad830652e9b1ead96> > > > > > > > > > > > > I have not yet receive feedback that makes me sure it's 100% > > > fixed, > > > > > so I'd > > > > > > actually be quite interested in another test case. However, > quite > > > > > honestly, > > > > > > if we can't run a better version on your box, there is no > point > > > for > > > > > me in > > > > > > further looking at that case (because it can't be solved > > > anyway...). > > > > > > > > > > > > Rainer > > > > > > > > > > > > > On Mon, Nov 8, 2010 at 6:39 PM, Rainer Gerhards > > > > > > > <[email protected]>wrote: > > > > > > > > > > > > > > > > -----Original Message----- > > > > > > > > > From: [email protected] > [mailto:rsyslog- > > > > > > > > > [email protected]] On Behalf Of matan monitz > > > > > > > > > Sent: Monday, November 08, 2010 3:51 PM > > > > > > > > > To: rsyslog-users > > > > > > > > > Subject: Re: [rsyslog] rsyslog Text File Input Module > > > losing > > > > > seek? > > > > > > > > > > > > > > > > > > hello rainer > > > > > > > > > we are using 3.22.1-3 from rpm on rhel 5 > > > > > > > > > > > > > > > > That's definitely too old. I maintain it when I am at it, > but > > > the > > > > > fix > > > > > > > went > > > > > > > > into v4+ so far. I suggest that you pull the latest v4- > stable > > > > > from > > > > > > > git. If > > > > > > > > git doesn't work for you, let me know and I'll mail you a > > > private > > > > > > > tarball. > > > > > > > > I > > > > > > > > am just right now very busy (probably tomorrow as well, > as I > > > am > > > > > > > writing a > > > > > > > > lot > > > > > > > > of new code in support for CEE). > > > > > > > > > > > > > > > > Rainer > > > > > > > > > > > > > > > > > > > > > > > > > > On Mon, Nov 8, 2010 at 3:46 PM, Rainer Gerhards > > > > > > > > > <[email protected]>wrote: > > > > > > > > > > > > > > > > > > > which version do you use? I have recently addressed > such > > > a > > > > > > > problem... > > > > > > > > > > > > > > > > > > > > Rainer > > > > > > > > > > > > > > > > > > > > > -----Original Message----- > > > > > > > > > > > From: [email protected] > > > [mailto:rsyslog- > > > > > > > > > > > [email protected]] On Behalf Of matan > monitz > > > > > > > > > > > Sent: Monday, November 08, 2010 2:45 PM > > > > > > > > > > > To: [email protected] > > > > > > > > > > > Subject: [rsyslog] rsyslog Text File Input Module > > > losing > > > > > seek? > > > > > > > > > > > > > > > > > > > > > > Hello all > > > > > > > > > > > we have a bind server writing and rotating logs on > file > > > > > system > > > > > > > > > > > (rotating > > > > > > > > > > > when log file reaches 10Mb). > > > > > > > > > > > we also have rsyslog configured with the text file > > > input > > > > > module > > > > > > > > > reading > > > > > > > > > > > the > > > > > > > > > > > file and sending it over UDP to another rsyslog > server. > > > > > > > > > > > several times during the day the rsyslog on the > bind > > > > > machine > > > > > > > starts > > > > > > > > > > > reading > > > > > > > > > > > the file from the top, causing a sudden high rate > of > > > > > duplicate > > > > > > > and > > > > > > > > > old > > > > > > > > > > > events. > > > > > > > > > > > in an attempt to identify the problem: > > > > > > > > > > > 1.verified this using tcpdump to make sure the and > saw > > > the > > > > > old > > > > > > > logs > > > > > > > > > > > coming > > > > > > > > > > > down the wire to the rsyslog server > > > > > > > > > > > 2.made sure state files are correctly configured > and > > > are > > > > > being > > > > > > > > > created > > > > > > > > > > > when > > > > > > > > > > > needed > > > > > > > > > > > 3.made sure the rsyslog is not crashing and > restarting > > > by > > > > > > > > > monitoring > > > > > > > > > > > the pid > > > > > > > > > > > googeling hasn't helped as well > > > > > > > > > > > > > > > > > > > > > > any ideas? > > > > > > > > > > > _______________________________________________ > > > > > > > > > > > rsyslog mailing list > > > > > > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > > > > > > http://www.rsyslog.com > > > > > > > > > > _______________________________________________ > > > > > > > > > > rsyslog mailing list > > > > > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > > > > > http://www.rsyslog.com > > > > > > > > > > > > > > > > > > > _______________________________________________ > > > > > > > > > rsyslog mailing list > > > > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > > > > http://www.rsyslog.com > > > > > > > > _______________________________________________ > > > > > > > > rsyslog mailing list > > > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > > > http://www.rsyslog.com > > > > > > > > > > > > > > > _______________________________________________ > > > > > > > rsyslog mailing list > > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > > http://www.rsyslog.com > > > > > > _______________________________________________ > > > > > > rsyslog mailing list > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > http://www.rsyslog.com > > > > > > > > > > > _______________________________________________ > > > > > rsyslog mailing list > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > http://www.rsyslog.com > > > > _______________________________________________ > > > > rsyslog mailing list > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > http://www.rsyslog.com > > > > > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
