File trunction is NOT handled by the current imfile. Previous versions tried to do that, but this resulted in a big nightmare, because there are various unavoidable races in the process that often resulted in a full re-send of the data. So it is important that a new file is created (aka the old one deleted). We could not see any problem with that approach, as a log file typically is appended but never truncated in some place.
Rainer > -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Anthony J. Biacco > Sent: Wednesday, September 28, 2011 7:33 PM > To: [email protected] > Subject: [rsyslog] inputfilemonitor with log truncate > > Hello, > > I'm running 5.8.4 compiled on centos 5.6. > I'm running rsyslog on a couple of my app servers and using the imfile > module to read my tomcat logs, and then I forward them onto a central > rsyslog server, also 5.8.4, with dated directories. > Every week or so I want to zero out/truncate my tomcat logs on the app > servers. So I've tried just doing a "echo > /path/to/log" and see how > it > went. > Well, then I tried to append some text "echo BLAH >> /path/to/log" to > the tomcat log and the file monitor didn't seem to pick it up and > forward it on to central. > So I HUPed rsyslogd. Retry append, still nothing. > Set "$HUPisRestart On". Retry, still nothing. > Restart rsyslogd service. Retry, still nothing. > Remove rsyslog state file for the log file, Restart rsyslogd service. > Retry, still nothing. > Stop rsyslogd service. Remove rsyslog state file for the log file. > Start > rsyslogd service. Retry. WORKS. > > Is this really how it's supposed to work? Or am I missing something? > Thanks in advance for any help. > > Command line switches are: > > -c4 -f /etc/rsyslog.conf -i /var/run/rsyslogd.pid > > Relevant config is: > > # Input config > $UDPServerRun 514 > $InputTCPServerRun 514 > $MaxMessageSize 64k > > $ActionQueueType LinkedList > $ActionQueueFileName disk-assisted-queue-file > $ActionResumeRetryCount -1 > $ActionQueueMaxDiskSpace 500M > $ActionQueueSaveOnShutdown on > $OMFileFlushOnTXEnd on > > $ActionFileDefaultTemplate TraditionalFormat > $template RFC3164fmt,"<%PRI%>%TIMESTAMP% %HOSTNAME% %syslogtag%%msg%" > > # catalina.out > $InputFileName /data/logs/tomcat/catalina.out > $InputFileTag tomcat-out: > $InputFileStateFile stat-catalina.out > $InputFileSeverity debug > $InputFileFacility local0 > $InputRunFileMonitor > > $InputFilePollInterval 3 > $InputFilePersistStateInterval 5000 > > # Output to corporate > *.* @@x.x.x.x:xxx;RFC3164fmt > $ActionExecOnlyWhenPreviousIsSuspended on > & /var/log/localbuffer > $ActionExecOnlyWhenPreviousIsSuspended off > > -Tony > --------------------------- > Manager, IT Operations > Format Dynamics, Inc. > P: 303-228-7327 > F: 303-228-7305 > [email protected] > http://www.formatdynamics.com > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
