David, I am not clear about what you are saying. Which version of the rsyslog are based on for the following statements.
" the reason that -HUP was changed from being a restart to just reopeing files (which is enough for log rotation to work) is because doing a full shutdown can take a long time, and can eventually timeout and throw away logs anyway." That is what I exactly need. We can't do a full restart of rsyslogd at all. However, if you look at the following website. The -HUP command was not supported, http://www.rsyslog.com/doc/v4compatibility.html The command normally used by the log rotation $ kill -HUP `cat /var/run/rsyslogd.pid` Will be replaced with rsyslog restart. $ /etc/init.d/rsyslog restart And I have tested using kill -HUP command to rsyslogd on version 5.8.5, it does not have any effect to the rsyslogd process. Thanks Victor -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of [email protected] Sent: Tuesday, October 11, 2011 4:41 PM To: rsyslog-users Subject: Re: [rsyslog] kill -HUP command issue On Tue, 11 Oct 2011, Michael Biebl wrote: > 2011/10/11 Lu, Victor <[email protected]>: >> Hi there, >> >> The following links discuss why kill -HUP is not supported by rsyslog, >> version 5 and above. >> >> http://www.rsyslog.com/doc/v4compatibility.html >> >> http://www.rsyslog.com/doc/v5compatibility.html >> >> Here is the note from the website: That code complexity reduction (and thus >> performance improvement) needs the restart-type HUP code to be removed, so >> these changes can (and will) only happen in version 5. >> >> However, restart of the rsyslog daemon will cause the syslog messages loss. >> Has anybody thought about it? Is there a way to guarantee no system log >> message loss like kill -HUP command provided? > > You could use systemd for that: > http://www.freedesktop.org/wiki/Software/systemd/syslog systemd doesn't solve the problem the reason that -HUP was changed from being a restart to just reopeing files (which is enough for log rotation to work) is because doing a full shutdown can take a long time, and can eventually timeout and throw away logs anyway. consider the case where you have messages in your queue that you cannot write to a destination (say a remote server is down for example), unless you have a disk assisted queue setup you cannot do anything except throw these messages away. you also cannot shutdown without message loss if you have a continuous stream of new messages arriving. having a -HUP do a full restart caused message loss at every -HUP because of the 'new messages continually arriving' for the common UDP syslog case, but without doing a HUP (or equivalent), you can't roll the log files as rsyslog would continue to write to the old (open) files. also, changing configurations (which is where you need to do a restart) is a _very_ rare condition compared to log rotation. you can avoid message loss on restart by using RELP for your transport protocol and disk assisted queues. does this solve your problems? or is there some other reason you are looking to do a full restart instead of just re-opening files and network connections on a HUP? David Lang _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
