On Thu, 2013-04-18 at 18:58 -0700, David Lang wrote: > On Thu, 18 Apr 2013, stormdancer wrote: > > > Hello > > > > I used rsyslog-5.8.6 for 1 years, some configure keyword like bellow: > > > > # configuration for rsyslog collectors > > # > > $template BareMsgFormat,"%msg:2:$:drop-last-lf%\n" > > $template MhStdLogFile, > > "/data01/data/apache/%hostname%/%syslogtag:R,ERE,1,BLANK:(.+)/(.+):--end%/%timestamp:1:4:date-rfc3339%_%timestamp:6:7:date-rfc3339%_%timestamp:9:10:date-rfc3339%/%syslogtag:R,ERE,2,BLANK:(.+)/(.+):--end%_%timestamp:1:4:date-rfc3339%_%timestamp:6:7:date-rfc3339%_%timestamp:9:10:date-rfc3339%_%timestamp:12:13:date-rfc3339%.log.gz" > > $OMFileAsyncWriting on > > $OMFileIOBufferSize 256k > > $OMFileFlushOnTXEnd off > > $OMFileFlushInterval 8 > > $OMFileZipLevel 6 > > *.* -?MhStdLogFile;BareMsgFormat > > > > When log begin to transfer I can see log file was generate on collector > > server. File was in gzip format and it's Bytes changes frequently (per 4K or > > some seconds). Its proved that configuration begin with $OMFile above takes > > effects. > > Yesterday, I update rsyslog to rsyslog-7.2.7 and rsyslog-7.3.10, some > > configuration changed to: > > > > # > > $template BareMsgFormat,"%msg:2:$:drop-last-lf%\n" > > $template MhStdLogFile, > > "/data01/data/apache/%hostname%/%syslogtag:R,ERE,1,BLANK:(.+)/(.+):--end%/%timestamp:1:4:date-rfc3339%_%timestamp:6:7:date-rfc3339%_%timestamp:9:10:date-rfc3339%/%syslogtag:R,ERE,2,BLANK:(.+)/(.+):--end%_%timestamp:1:4:date-rfc3339%_%timestamp:6:7:date-rfc3339%_%timestamp:9:10:date-rfc3339%_%timestamp:12:13:date-rfc3339%.log.gz" > > # $OMFileAsyncWriting on > > # $OMFileIOBufferSize 256k > > # $OMFileFlushOnTXEnd off > > # $OMFileFlushInterval 8 > > action(type="omfile" ZipLevel="6" CreateDirs="on" DirCreateMode="0755" > > FileCreateMode="0644" IOBufferSize="256k" ASyncWriting="on" > > FlushOnTXEnd="off" FlushInterval="8" DynaFile="MhStdLogFile" > > Template="BareMsgFormat") > > > > Now, when log begin to transfer, file also can generate in dest dir on > > collector server and in gzip format. But this time file changed NOT > > frequently. It seems that configuration (IOBufferSize="256k" > > ASyncWriting="on" FlushOnTXEnd="off" FlushInterval="8") did not take > > effects. Until I shutdown the rsyslog with 'service rsyslog stop|restart' > > then file-size increased. In my case, file generate per hour, I always find > > that all the files in recent hours are only 10byte-sized. When I shutdown > > the server, all file-size will increased an bigger then 10byte. > > > > All rsyslog talked above I use the some configure command bellow: > > # ./configure --prefix=/apps/usr/rsyslog-x.x.xx --enable-impstats > > # ./configure --prefix=/apps/usr/rsyslog-7.3.10 --enable-impstats > > > > I have noticed the description about ASyncWriting FlushOnTXEnd and > > FlushInterval in help documents, but I am still confused. > > Waiting for your answer, tks a lot. > > Sorry for my poor english, hope I can describe the right problem. > > There is a high probability that if you start rsyslog in debug mode > (http://www.rsyslog.com/doc/troubleshoot.html), that the log it outputs will > have some messages that tell us what's going on when it defines the action. > You > probably do not need it to process any logs (or if any, very few) as the > problem is likely to be found at the time the action is defined. > > Rainer will probably need to look at this when he gets in the office (usually > about 3-4 hours from now)
If I understood correctly, the old version was buggy (and, yes, I remember such a bug). If the buffer is set to 256KiB and async writing and no commit on TX end, then rsyslog shall only write when the 256KiB have filled up. Together with ZIP mode, this may mean it needs to have two to four MiB before doing a write. Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
