I'll bet that you are running a very old version of rsyslog that does a full
stop and start on a HUP. That will cause this sort of data loss.
It's only on newer versions that it only reopens files
I believe that on v4 and v5 you had the option to do either way, but it
defaulted to a full restart unless you configured HUPisRestart false (or
something similar, I'd have to dig for it now)
With a version or config that doesn't do a full restart, I've hit rsyslog with
logs at gig-e wirespeed without loosing data in a HUP
David Lang
On Tue, 14 Jan 2014, Robert wrote:
Date: Tue, 14 Jan 2014 23:07:58 +0100
From: Robert <[email protected]>
Reply-To: rsyslog-users <[email protected]>
To: [email protected]
Subject: [rsyslog] HUP signal and data loss
Hi,
I have a doubt about rotation of logs write by rsyslog.
In our environment we have network devices that send log messages to
rsyslog, with a result of a continuos stream of data. We have both
dynafiles and static files.
For log rotation I thought to use a “classic” logrotation conf:
/var/log/my.log {
sharedscripts
postrotate
killall -HUP rsyslogd
endscript
}
or a shell script with same effects that first move log file and then send
kill –HUP to rsyslog.
I already know that HUP signal just reopeing files.
My doubt is: in a new messages continually arriving situation as mine, HUP
signal give me assurance of no data loss.
Thanks, best regards
Robert
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
