Hello I used rsyslog-5.8.6 for 1 years, some configure keyword like bellow:
# configuration for rsyslog collectors # $template BareMsgFormat,"%msg:2:$:drop-last-lf%\n" $template MhStdLogFile, "/data01/data/apache/%hostname%/%syslogtag:R,ERE,1,BLANK:(.+)/(.+):--end%/%timestamp:1:4:date-rfc3339%_%timestamp:6:7:date-rfc3339%_%timestamp:9:10:date-rfc3339%/%syslogtag:R,ERE,2,BLANK:(.+)/(.+):--end%_%timestamp:1:4:date-rfc3339%_%timestamp:6:7:date-rfc3339%_%timestamp:9:10:date-rfc3339%_%timestamp:12:13:date-rfc3339%.log.gz" $OMFileAsyncWriting on $OMFileIOBufferSize 256k $OMFileFlushOnTXEnd off $OMFileFlushInterval 8 $OMFileZipLevel 6 *.* -?MhStdLogFile;BareMsgFormat When log begin to transfer I can see log file was generate on collector server. File was in gzip format and it's Bytes changes frequently (per 4K or some seconds). Its proved that configuration begin with $OMFile above takes effects. Yesterday, I update rsyslog to rsyslog-7.2.7 and rsyslog-7.3.10, some configuration changed to: # $template BareMsgFormat,"%msg:2:$:drop-last-lf%\n" $template MhStdLogFile, "/data01/data/apache/%hostname%/%syslogtag:R,ERE,1,BLANK:(.+)/(.+):--end%/%timestamp:1:4:date-rfc3339%_%timestamp:6:7:date-rfc3339%_%timestamp:9:10:date-rfc3339%/%syslogtag:R,ERE,2,BLANK:(.+)/(.+):--end%_%timestamp:1:4:date-rfc3339%_%timestamp:6:7:date-rfc3339%_%timestamp:9:10:date-rfc3339%_%timestamp:12:13:date-rfc3339%.log.gz" # $OMFileAsyncWriting on # $OMFileIOBufferSize 256k # $OMFileFlushOnTXEnd off # $OMFileFlushInterval 8 action(type="omfile" ZipLevel="6" CreateDirs="on" DirCreateMode="0755" FileCreateMode="0644" IOBufferSize="256k" ASyncWriting="on" FlushOnTXEnd="off" FlushInterval="8" DynaFile="MhStdLogFile" Template="BareMsgFormat") Now, when log begin to transfer, file also can generate in dest dir on collector server and in gzip format. But this time file changed NOT frequently. It seems that configuration (IOBufferSize="256k" ASyncWriting="on" FlushOnTXEnd="off" FlushInterval="8") did not take effects. Until I shutdown the rsyslog with 'service rsyslog stop|restart' then file-size increased. In my case, file generate per hour, I always find that all the files in recent hours are only 10byte-sized. When I shutdown the server, all file-size will increased an bigger then 10byte. All rsyslog talked above I use the some configure command bellow: # ./configure --prefix=/apps/usr/rsyslog-x.x.xx --enable-impstats # ./configure --prefix=/apps/usr/rsyslog-7.3.10 --enable-impstats I have noticed the description about ASyncWriting FlushOnTXEnd and FlushInterval in help documents, but I am still confused. Waiting for your answer, tks a lot. Sorry for my poor english, hope I can describe the right problem. -- At 2013-04-18 22:31:37,"David Lang" <[email protected]> wrote: >could you please re-send your message, everything is run together in a way >that >makes it very hard to read. > >David Lang > >On Thu, 18 Apr 2013, stormdancer wrote: > > >> Date: Thu, 18 Apr 2013 01:50:52 -0700 (PDT) >> From: stormdancer <[email protected]> >> Reply-To: rsyslog-users <[email protected]> >> To: [email protected] >> Subject: [rsyslog] Is FlushInterval failure in new version? >> >> Hello I used rsyslog-5.8.6 for 1 years, some configure keyword like >> bellow: # configuration for rsyslog collectors # $template >> BareMsgFormat,"%msg:2:$:drop-last-lf%\n" $template MhStdLogFile, >> "/data01/data/apache/%hostname%/%syslogtag:R,ERE,1,BLANK:(.+)/(.+):--end%/%timestamp:1:4:date-rfc3339%_%timestamp:6:7:date-rfc3339%_%timestamp:9:10:date-rfc3339%/%syslogtag:R,ERE,2,BLANK:(.+)/(.+):--end%_%timestamp:1:4:date-rfc3339%_%timestamp:6:7:date-rfc3339%_%timestamp:9:10:date-rfc3339%_%timestamp:12:13:date-rfc3339%.log.gz" >> $OMFileAsyncWriting on $OMFileIOBufferSize 256k $OMFileFlushOnTXEnd >> off $OMFileFlushInterval 8 $OMFileZipLevel 6 *.* >> -?MhStdLogFile;BareMsgFormat When log begin to transfer I can see log >> file was generate on collector server. File was in gzip format and it's >> Bytes changes frequently (per 4K or some seconds). Its proved that >> configuration begin with $OMFile above takes effects. Yesterday, I update >> rsyslog to rsyslog-7.2.7 and rsyslog-7.3.10, some configuration changed to: >> # $template BareMsgFormat,"%msg:2:$:drop-last-lf%\n" $template >> MhStdLogFile, >> "/data01/data/apache/%hostname%/%syslogtag:R,ERE,1,BLANK:(.+)/(.+):--end%/%timestamp:1:4:date-rfc3339%_%timestamp:6:7:date-rfc3339%_%timestamp:9:10:date-rfc3339%/%syslogtag:R,ERE,2,BLANK:(.+)/(.+):--end%_%timestamp:1:4:date-rfc3339%_%timestamp:6:7:date-rfc3339%_%timestamp:9:10:date-rfc3339%_%timestamp:12:13:date-rfc3339%.log.gz" >> # $OMFileAsyncWriting on # $OMFileIOBufferSize 256k # >> $OMFileFlushOnTXEnd off # $OMFileFlushInterval 8 action(type="omfile" >> ZipLevel="6" CreateDirs="on" DirCreateMode="0755" FileCreateMode="0644" >> IOBufferSize="256k" ASyncWriting="on" FlushOnTXEnd="off" FlushInterval="8" >> DynaFile="MhStdLogFile" Template="BareMsgFormat") Now, when log begin to >> transfer, file also can generate in dest dir on collector server and in gzip >> format. But this time file changed NOT frequently. It seems that >> configuration (IOBufferSize="256k" ASyncWriting="on" FlushOnTXEnd="off" >> FlushInterval="8") did not take effects. Until I shutdown the rsyslog with >> 'service rsyslog stop|restart' then file-size increased. In my case, file >> generate per hour, I always find that all the files in recent hours are only >> 10K-sized. When I shutdown the server, all file-size will increased an >> bigger then 10K. All rsyslog talked above I use the some configure >> command bellow: # ./configure --prefix=/apps/usr/rsyslog-x.x.xx >> --enable-impstats # ./configure --prefix=/apps/usr/rsyslog-7.3.10 >> --enable-impstats I have noticed the description about ASyncWriting >> FlushOnTXEnd and FlushInterval in help documents, but I am still confused. >> Waiting for your answer, tks a lot. Sorry for my poor english, hope I can >> describe the right problem. >> >> >> >> -- >> View this message in context: >> http://rsyslog-rsyslog-users.1305293.n2.nabble.com/Is-FlushInterval-failure-in-new-version-tp7580235.html >> Sent from the rsyslog -- rsyslog-users mailing list archive at Nabble.com. >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of >> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T >> LIKE THAT. >> >_______________________________________________ >rsyslog mailing list >http://lists.adiscon.net/mailman/listinfo/rsyslog >http://www.rsyslog.com/professional-services/ >What's up with rsyslog? Follow https://twitter.com/rgerhards >NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of >sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE >THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
