On Fri, 22 Nov 2013, Chastity Blackwell wrote:
Earlier this week, I had to restart the rsyslog daemon (v7.4.5) on one
of our rsyslog aggregators/archivers to put in some new configs, and it
did not shut down cleanly; this corrupted the gzipped archive that the
daemon writes logs out to, making it unreadable (without heroic
measures, at least). Since we have redundant archives, this was not a
horrific problem, but I'm wondering if there's some sort of action I can
take to make sure this does not happen in the future. Any suggestions?
when you are using rsyslog to compress the logs, there is more buffering
involved than with normal plaintext output. On an unclean shutdown the tail end
of the logs is not cleanly written, and so you will get a gzip error when
reading the logs.
you will get the same result if you copy the logs too quickly after a HUP, the
tail end of the log is not written
However, this should only affect the very tail end of the logs, everything
earlier should be readable.
There is an option to make this more robust, but it hurts your compression
ratio significantly, and you still have the log loss from buffered data
from http://www.rsyslog.com/doc/omfile.html
VeryRobustZip [on/off] (v7.3.0+) - if ZipLevel is greater 0, then this setting
controls if extra headers are written to make the resulting file extra hardened
against malfunction. If set to off, data appended to previously unclean closed
files may not be accessible without extra tools. Note that this risk is usually
expected to be bearable, and thus "off" is the default mode. The extra headers
considerably degrade compression, files with this option set to "on" may be four
to five times as large as files processed in "off" mode.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
