On Wed, Nov 2, 2011 at 11:25 AM, Michael Biebl <[email protected]> wrote:
>
> 2011/11/1 Bob Corsaro <[email protected]>:
> > If there is a better way to do what I'm doing, I'm all ears. I just
> > basically need to send varnish logs to a syslog daemon on a remote server.
> >
> > I'm using rsyslog 4.2.0 packaged with Ubuntu lucid to ship varnish logs to
> > a remote server. The related part of my config looks like this:
>
> [..]
>
> > Anyway, I tried upgrading to 4.8.0, which does leave a state file in
> > $WorkDirectory right away, instead of waiting for rsyslog to exit, but it
> > doesn't seem to respect the $InputFilePersistStateInterval . I've received
> > well over 20k logs since starting it, but the state file remains unchanged.
>
> I've been working on a scenario similar to yours. Several Ubuntu Lucid
> servers with 4.2 which read from a custom log file and forward that to
> a central rsyslog server collecting the logs.
> I also noticed, that 4.2 does not create the state file and iirc I've
> also seen the resend-logs-on-restart issue, you mentioned, but I
> haven't investigated that further.
>
> Rainer generally recommends to *not* use 4.2.
> I'm suprised though, as you mentioned that 4.8 is showing the same
> behaviour, unless I misunderstood you.
It's not displaying the exact same behavior. It is creating a state
file, but it doesn't seem to respect the persist state interval. At
any rate I'm going to stick with 4.2.0 for now. I think the problem
was logrotate messing around with inodes and filenames and confusing
rsyslog. As a workaround, I've added the following configuration to
logrotate for varnish:
/var/log/varnish/varnish.log /var/log/varnish/varnishncsa.log {
daily
rotate 7
missingok
compress
delaycompress
missingok
firstaction
stop rsyslog
rm /var/spool/rsyslog/my-state-file
endscript
lastaction
start rsyslog
endscript
postrotate
for service in varnishlog varnishncsa; do
if /usr/bin/pgrep -P 1 $service >/dev/null; then
/usr/sbin/invoke-rc.d $service reload > /dev/null
fi
done
endscript
}
I may lose a few logs at the end of the day with this method, but It's
better then what I had before. I'm using this data to charge customers
so I'd rather err on the low side of things. It would be better if I
could just have varnish log directly to the remote syslog server :P.
Varnish does support syslog in vcl so maybe I'll try it at some point.
If anyone has any improvement, I'm always open to suggestion. Sorry
for top posting earlier, I haven't used a mailing list in a while.
Bob Corsaro
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
