Hello,
I'm trying to configure rsyslog to collect logs for a web application using
the imfile module. I only have 4 imfile inputs configured, but rsyslogd
won't start unless I only have 2 at the most. If I run 'sudo rsyslogd -dn',
the tail of the output looks like this:
4963.196879382:7fd16ef45700: main Q: qqueueAdd: entry added, size now log
69, phys 72 entries
4963.196889949:7fd16ef45700: main Q: qqueueAdd: entry added, size now log
70, phys 73 entries
4963.196901182:7fd16ef45700: main Q: MultiEnqObj advised worker start
4963.196919437:7fd16ef45700: DDDD: imfile: enter into wdmap[3]: wd 4, dir
-1, file 1
4963.196931055:7fd16ef45700: DDDD: watch 4 added for file
/var/log/nginx/error.log
4963.196951059:7fd16ef45700: imfile: increased dir table to 4 entries
4963.196962765:7fd16ef45700: DDDD: associated file
1[/var/log/nginx/error.log] to directory 0[/var/log/nginx]
4963.196977470:7fd16ef45700: filemon 0x7fd1710d8278: clean startup, no .si
file found
4963.196990293:7fd16ef45700: file stream /var/log/nginx/error.log params:
flush interval 0, async write 0
4963.197009221:7fd16ef45700: file '/var/log/nginx/error.log' opened as #8
with mode 384
4963.197026642:7fd16ef45700: strm 0x7fd1711ea280: opened file
'/var/log/nginx/error.log' for READ as 8
4963.197051216:7fd16ef45700: strm 0x7fd1711ea280: file 8 read 0 bytes
4963.197076670:7fd16ef45700: stream checking for file change on
'/var/log/nginx/error.log', inode 262240/262240
4963.197111945:7fd16ef45700: DDDD: imfile: enter into wdmap[4]: wd 5, dir
-1, file 2
4963.197131988:7fd16ef45700: DDDD: watch 5 added for file
/var/log/pts/pts-worker-1.log
Many lines up is the output for file 1 (/var/log/nginx/access.log), which
looks pretty much identical to the file 2 (/var/log/nginx/error.log)
output. The last line of the output is for file 3, but the process dies
after that. If I comment out file 3 and 4 in the config, rsyslogd starts up
fine. So it seems like it won't do more than 2 files. I deleted the state
files trying to troubleshoot this, so I don't have those.
Config file:
module(load="imfile" PollingInterval="1")
# File 1
input(type="imfile" File="/var/log/nginx/access.log"
Tag="nginx-access:"
StateFile="nginx-access"
Severity="info"
Facility="local7")
# File 2
input(type="imfile" File="/var/log/nginx/error.log"
Tag="nginx-error:"
StateFile="nginx-error"
Severity="error"
Facility="local7")
# File 3
input(type="imfile" File="/var/log/pts/pts-web-1.log"
Tag="pts-web-1:"
StateFile="pts-web-1"
Severity="info"
Facility="local7")
# File 4
input(type="imfile" File="/var/log/pts/pts-worker-1.log"
Tag="pts-worker-1"
StateFile="pts-worker-1"
Severity="info"
Facility="local7")
System info:
Ubuntu 14.04
rsyslog -v output:
rsyslogd 8.2.1, compiled with:
FEATURE_REGEXP: Yes
FEATURE_LARGEFILE: No
GSSAPI Kerberos 5 support: No
FEATURE_DEBUG (debug build, slow code): No
32bit Atomic operations supported: Yes
64bit Atomic operations supported: Yes
memory allocator: jemalloc
Runtime Instrumentation (slow code): No
uuid support: Yes
Number of Bits in RainerScript integers: 64
Thanks so much for any help with this!
-Alex
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
