> -----Original Message-----
> From: [email protected] [mailto:rsyslog-
> [email protected]] On Behalf Of David Lang
> Sent: Wednesday, February 06, 2013 7:21 AM
> To: rsyslog-users
> Subject: Re: [rsyslog] Imfile sporadically sending messages
>
> It's very unlikely that the problem is keeping up
>
> read mode 2 means that it can't consider a log paragraph read until it has the
> beginning of the next log message (it doesn't know if there is more data
> pending on the log it's got)
>
> I think that Rainer will need to take a look at this, is there anything
> showing
> up in a debug run?
>
Just to chime in that I am unfortunately extremely busy at the moment. I can
have a quick lock at the debug log, but not more, probably for the next 2
weeks. Sorry for that,
Rainer
> David Lang
>
> On Tue, 5 Feb 2013, Brian Harris wrote:
>
> > I use rsyslog and the imfile module to watch some application logs and
> > send to a central syslog server.
> > imfile is sporadically sending messages to the remote server. On a few
> > servers it works as expected but it isn't consistent.
> >
> > I receive about 191 new events (lines) per minute and its only sending
> > a few messages every couple of minutes.
> >
> > A tcpdump confirmed the all messages are not being sent from the host.
> >
> > rsyslog-5.10.1-4.el5.centos.x86_64.rpm
> >
> > ReadMode 2 works indented and not 1 not like the doc says.
> > http://www.rsyslog.com/doc/imfile.html
> >
> > Is it possible that it can't keep up? I watch the state files and it
> > doesn't seem like they update at all after they are created.
> >
> >
> >
> > #Sample Config
> > $ModLoad imfile
> >
> > #Watch java app log with multiline support $InputFileName
> > /logs/app1.log $InputFileReadMode 2 $InputFileTag app1-log:
> > $InputFileStateFile state-app1-log
> > $InputFileFacility local6
> > $InputFileSeverity debug
> > $InputRunFileMonitor
> >
> > #Watch app access log
> > $InputFileName /logs/app1-access.log
> > $InputFileTag app1-access:
> > $InputFileStateFile state-app1-access
> > $InputFileFacility local7
> > $InputFileSeverity debug
> > $InputRunFileMonitor
> >
> > *.* @syslog:5144
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE
> > WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites
> beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
> LIKE THAT.
> >
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL:
> This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond
> our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
