Ok, it seems when I enable debug on demand all logs start to show up but once I disable debug its sporadically sending them again. And note that this only happens for a few monitored files and not the rest. I couldn't get ReadMode 1 to work for java exceptions so I found some rsyslog documentation to use ReadMode 2 for indent and that actually works me.
Where is the best place to post debug logs? On Wed, Feb 6, 2013 at 8:01 AM, Rainer Gerhards <[email protected]>wrote: > > > > -----Original Message----- > > From: [email protected] [mailto:rsyslog- > > [email protected]] On Behalf Of David Lang > > Sent: Wednesday, February 06, 2013 7:21 AM > > To: rsyslog-users > > Subject: Re: [rsyslog] Imfile sporadically sending messages > > > > It's very unlikely that the problem is keeping up > > > > read mode 2 means that it can't consider a log paragraph read until it > has the > > beginning of the next log message (it doesn't know if there is more data > > pending on the log it's got) > > > > I think that Rainer will need to take a look at this, is there anything > showing > > up in a debug run? > > > Just to chime in that I am unfortunately extremely busy at the moment. I > can have a quick lock at the debug log, but not more, probably for the next > 2 weeks. Sorry for that, > Rainer > > David Lang > > > > On Tue, 5 Feb 2013, Brian Harris wrote: > > > > > I use rsyslog and the imfile module to watch some application logs and > > > send to a central syslog server. > > > imfile is sporadically sending messages to the remote server. On a few > > > servers it works as expected but it isn't consistent. > > > > > > I receive about 191 new events (lines) per minute and its only sending > > > a few messages every couple of minutes. > > > > > > A tcpdump confirmed the all messages are not being sent from the host. > > > > > > rsyslog-5.10.1-4.el5.centos.x86_64.rpm > > > > > > ReadMode 2 works indented and not 1 not like the doc says. > > > http://www.rsyslog.com/doc/imfile.html > > > > > > Is it possible that it can't keep up? I watch the state files and it > > > doesn't seem like they update at all after they are created. > > > > > > > > > > > > #Sample Config > > > $ModLoad imfile > > > > > > #Watch java app log with multiline support $InputFileName > > > /logs/app1.log $InputFileReadMode 2 $InputFileTag app1-log: > > > $InputFileStateFile state-app1-log > > > $InputFileFacility local6 > > > $InputFileSeverity debug > > > $InputRunFileMonitor > > > > > > #Watch app access log > > > $InputFileName /logs/app1-access.log > > > $InputFileTag app1-access: > > > $InputFileStateFile state-app1-access > > > $InputFileFacility local7 > > > $InputFileSeverity debug > > > $InputRunFileMonitor > > > > > > *.* @syslog:5144 > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com/professional-services/ > > > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE > > > WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites > > beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > > LIKE THAT. > > > > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: > > This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites > beyond > > our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
