On Thu, 3 Nov 2011, Bob Corsaro wrote:
On Wed, Nov 2, 2011 at 3:15 PM, Andreas Piesk <[email protected]> wrote:
On 02.11.2011 16:00, Bob Corsaro wrote:
Yes. I think it could be logrotate causing the issue. Are there any best
practices to avoid duplicate logs? I open to an alternative option for
rolling the logs.
have you considered sending the logs after they have been rotated to avoid any
duplicates?
you know, something like 'logger -p local0.debug -f <file>', probably in
logrotates post-script?
I could but then I don't get realtime reporting, which is super cool.
i have test cases even for 5.8.6 where at least some lines are duplicated but
it doesn't matter in
my case because i use syslog for monitoring/security only, not for accounting.
:( The disadvantage of going directly from varnish to the remote
syslog server is that I lose the ability to store logs if the remote
syslog daemon is unavailable. Why do you think you get duplicates?
Two options there.
1. go to a local syslog daemon and let it forward
2. make your remote syslog daemon highly available.
writing to a file and then picking it up later is one of the most
complicated approaches that you can take to move logs.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
