We have a problem with the queueing of logs on our servers. We have an application server logging to a remote log server that consolidates logs from a number of servers. The logs this server is forwarding are being read in via imfile and sent to the remote server.
In the working directory on the application server, there are currently ~1400 spool files filling the disk. Most messages are getting through to the log server. Some seem not to be. When I spot-check the log file imfile is reading from against the remote log, it looks like most are getting through (I haven't found any that didn't get to the log server), but if I use logger to put in a test message. Looking at the .qi file the queue is getting processed, but it's about 60 files behind. I'm not familiar with the contents but it has a line: +iCurrFNum:2:4:1328: and 1328 is the file number of the queue file that's older than the .qi file. the .qi file gets updated rarely. We've also had some problems with duplicate messages. So I have a few questions: 1) What might be causing these problems, and how can I fix them 2) Can we safely just delete the queue files older than the .qi file to keep the disk from filling up -- Eric _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
