On Thu, 18 Apr 2013, stormdancer wrote:
HelloI used rsyslog-5.8.6 for 1 years, some configure keyword like bellow: # configuration for rsyslog collectors # $template BareMsgFormat,"%msg:2:$:drop-last-lf%\n" $template MhStdLogFile, "/data01/data/apache/%hostname%/%syslogtag:R,ERE,1,BLANK:(.+)/(.+):--end%/%timestamp:1:4:date-rfc3339%_%timestamp:6:7:date-rfc3339%_%timestamp:9:10:date-rfc3339%/%syslogtag:R,ERE,2,BLANK:(.+)/(.+):--end%_%timestamp:1:4:date-rfc3339%_%timestamp:6:7:date-rfc3339%_%timestamp:9:10:date-rfc3339%_%timestamp:12:13:date-rfc3339%.log.gz" $OMFileAsyncWriting on $OMFileIOBufferSize 256k $OMFileFlushOnTXEnd off $OMFileFlushInterval 8 $OMFileZipLevel 6 *.* -?MhStdLogFile;BareMsgFormat When log begin to transfer I can see log file was generate on collector server. File was in gzip format and it's Bytes changes frequently (per 4K or some seconds). Its proved that configuration begin with $OMFile above takes effects. Yesterday, I update rsyslog to rsyslog-7.2.7 and rsyslog-7.3.10, some configuration changed to: # $template BareMsgFormat,"%msg:2:$:drop-last-lf%\n" $template MhStdLogFile, "/data01/data/apache/%hostname%/%syslogtag:R,ERE,1,BLANK:(.+)/(.+):--end%/%timestamp:1:4:date-rfc3339%_%timestamp:6:7:date-rfc3339%_%timestamp:9:10:date-rfc3339%/%syslogtag:R,ERE,2,BLANK:(.+)/(.+):--end%_%timestamp:1:4:date-rfc3339%_%timestamp:6:7:date-rfc3339%_%timestamp:9:10:date-rfc3339%_%timestamp:12:13:date-rfc3339%.log.gz" # $OMFileAsyncWriting on # $OMFileIOBufferSize 256k # $OMFileFlushOnTXEnd off # $OMFileFlushInterval 8 action(type="omfile" ZipLevel="6" CreateDirs="on" DirCreateMode="0755" FileCreateMode="0644" IOBufferSize="256k" ASyncWriting="on" FlushOnTXEnd="off" FlushInterval="8" DynaFile="MhStdLogFile" Template="BareMsgFormat") Now, when log begin to transfer, file also can generate in dest dir on collector server and in gzip format. But this time file changed NOT frequently. It seems that configuration (IOBufferSize="256k" ASyncWriting="on" FlushOnTXEnd="off" FlushInterval="8") did not take effects. Until I shutdown the rsyslog with 'service rsyslog stop|restart' then file-size increased. In my case, file generate per hour, I always find that all the files in recent hours are only 10byte-sized. When I shutdown the server, all file-size will increased an bigger then 10byte. All rsyslog talked above I use the some configure command bellow: # ./configure --prefix=/apps/usr/rsyslog-x.x.xx --enable-impstats # ./configure --prefix=/apps/usr/rsyslog-7.3.10 --enable-impstats I have noticed the description about ASyncWriting FlushOnTXEnd and FlushInterval in help documents, but I am still confused. Waiting for your answer, tks a lot. Sorry for my poor english, hope I can describe the right problem.
There is a high probability that if you start rsyslog in debug mode (http://www.rsyslog.com/doc/troubleshoot.html), that the log it outputs will have some messages that tell us what's going on when it defines the action. You probably do not need it to process any logs (or if any, very few) as the problem is likely to be found at the time the action is defined.
Rainer will probably need to look at this when he gets in the office (usually about 3-4 hours from now)
David Lang _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
