Thanks, based on your feedback, David, I whipped up a test with backlogged messages in the new file prior to rolling over the symlink and it behaved just like Rainer is saying. It caught up just fine, and didn't miss a beat.
I'll post any issues I may run into, but it seems like a solid solution for my use case. Thanks again guys, Greg On Mon, Mar 25, 2013 at 2:54 PM, Rainer Gerhards <[email protected]>wrote: > Imfile doesn't need Hup. It checks the inode number, as long as it > changes, no problem. > > > Sent from phone, thus brief. > > > > -------- Ursprüngliche Nachricht -------- > Von: David Lang <[email protected]> > Datum: 25.03.2013 19:50 (GMT+01:00) > An: rsyslog-users <[email protected]> > Betreff: Re: [rsyslog] update imfile tail for file with date in filename > > > remember that after you change the symlink, you need to HUP rsyslog to > have it > close and re-open it's files. > > You may run into another problem though. If rsyslog thinks that it's > dealing > with the same file, it may not properly reset to reading the start of the > file. > I don't know the details of what it does in those conditions. > > David Lang > > > On Mon, 25 Mar 2013, Gregory Patmore wrote: > > > Date: Mon, 25 Mar 2013 14:46:52 -0400 > > From: Gregory Patmore <[email protected]> > > Reply-To: rsyslog-users <[email protected]> > > To: rsyslog-users <[email protected]> > > Subject: [rsyslog] update imfile tail for file with date in filename > > > > Tried to reply to Rainer's reply, but hasn't seemed to go through. Not > sure > > what happened, but here it is again: > > > > Thanks Rainer, > > > > I *think* I may have worked out something that may be a bit less > > complicated, interested in your thoughts on {rel,v}iability: > > > > touch testfile.txt. > > ln -s testfile.txt current.txt > > > > # then set the rsyslog.conf to tail current.txt and restarted > > > > echo "test@$(date %s)" >> testfile.txt; # works. rsyslog caught and > handled > > new message > > echo "test@$(date %s)" >> current.txt; # works. same > > > > #update sym link and re-test > > touch testfile2.txt > > ln -f -s testfile2.txt current.txt > > > > echo "test@$(date %s)" >> testfile2.txt; # works. rsyslog caught and > > handled new message > > echo "test@$(date %s)" >> current.txt; # works. same > > echo "test@$(date %s)" >> testfile.txt; # doesn't work anymore. rsyslog > no > > longer monitoring > > > > If this works I can just write a crontab task to update symlink nightly. > > Am I missing anything? > > > > Thanks again for you help. > > > > Greg > > > > > > On Mon, Mar 25, 2013 at 11:09 AM, Rainer Gerhards < > [email protected]> > > wrote: > > > >> On Mon, 2013-03-25 at 11:06 -0400, Gregory Patmore wrote: > >>> Hi all, > >>> > >>> Apologies for what may be such a beginner question, but I'm trying to > >> work > >>> out a file tail using imfile, but the file I want to tail is generated > >> with > >>> a date portion in the file name. > >>> > >>> filename format is: access_log.YYYY-MM-DD.txt > >>> > >>> Is it possible to set it up to watch a new file each day, and if so, > can > >>> anyone help me out with some guidance on the conf file syntax? > >>> > >> simple and unsatisfactory answer: it's currently not possible. However, > >> an imfile rewrite/extension is scheduled for the first half of this > >> year. > >> > >> A work-around may be to write a new config file via cron and a tool by > >> midnight and restart rsyslog to pick it up. I know: it's ugly - but it > >> works... > >> > >> Rainer > >>> > >>> Thanks for any help/advice you can give. > >> > >> _______________________________________________ > >> rsyslog mailing list > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > >> http://www.rsyslog.com/professional-services/ > >> What's up with rsyslog? Follow https://twitter.com/rgerhards > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > >> DON'T LIKE THAT. > >> > > > > > > > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > -- --Gregory Patmore | Senior DevOps Engineerappssavvy <http://appssavvy.com/>594 Broadway Suite 207 | New York, NY 10012C | 732.492.4140 [email protected] _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
