If there is a better way to do what I'm doing, I'm all ears. I just basically need to send varnish logs to a syslog daemon on a remote server.
I'm using rsyslog 4.2.0 packaged with Ubuntu lucid to ship varnish logs to a remote server. The related part of my config looks like this: $InputFileName /var/log/varnish/varnishncsa.log $InputFileTag varnish: $InputFileStateFile stat-varnish $InputFileSeverity debug $InputFileFacility local0 $InputRunFileMonitor $InputFilePollInterval 1 $InputFilePersistStateInterval 20000 local0.* @@varnish-log-processor:515 I realize that $InputFilePersistStateInterval is not supported in 4.2.0, I'll get to that later. The problem is that I'm seeing the same logs sent to varnish-log-processor mutliple times. At some point something happens and all the logs, starting at the beginning of the file, are resent. I'm assuming rsyslog is dying and the state file isn't being created on exit. I did see this in my messages log this morning: Nov 1 04:27:16 balancer01 rsyslogd: [origin software="rsyslogd" swVersion="4.2.0" x-pid="14143" x-info="http://www.rsyslog.com";] rsyslogd was HUPed, type 'lightweight'. Anyway, I tried upgrading to 4.8.0, which does leave a state file in $WorkDirectory right away, instead of waiting for rsyslog to exit, but it doesn't seem to respect the $InputFilePersistStateInterval . I've received well over 20k logs since starting it, but the state file remains unchanged. If anyone knows if this problem is related to the way varnish logs, or is a known bug, or any other advice, it would be much appreciated. Thanks, Bob Corsaro _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
