I will say I'm doing g more then 2 imfiles with no problem. Does /car/log/messages give you an error when it fails?
Any selinux issues? Could it be an output issue? Are they all going to the same place? On May 17, 2014 10:06 PM, "Alex Bird" <[email protected]> wrote: > Hello, > > I'm trying to configure rsyslog to collect logs for a web application using > the imfile module. I only have 4 imfile inputs configured, but rsyslogd > won't start unless I only have 2 at the most. If I run 'sudo rsyslogd -dn', > the tail of the output looks like this: > > 4963.196879382:7fd16ef45700: main Q: qqueueAdd: entry added, size now log > 69, phys 72 entries > 4963.196889949:7fd16ef45700: main Q: qqueueAdd: entry added, size now log > 70, phys 73 entries > 4963.196901182:7fd16ef45700: main Q: MultiEnqObj advised worker start > 4963.196919437:7fd16ef45700: DDDD: imfile: enter into wdmap[3]: wd 4, dir > -1, file 1 > 4963.196931055:7fd16ef45700: DDDD: watch 4 added for file > /var/log/nginx/error.log > 4963.196951059:7fd16ef45700: imfile: increased dir table to 4 entries > 4963.196962765:7fd16ef45700: DDDD: associated file > 1[/var/log/nginx/error.log] to directory 0[/var/log/nginx] > 4963.196977470:7fd16ef45700: filemon 0x7fd1710d8278: clean startup, no .si > file found > 4963.196990293:7fd16ef45700: file stream /var/log/nginx/error.log params: > flush interval 0, async write 0 > 4963.197009221:7fd16ef45700: file '/var/log/nginx/error.log' opened as #8 > with mode 384 > 4963.197026642:7fd16ef45700: strm 0x7fd1711ea280: opened file > '/var/log/nginx/error.log' for READ as 8 > 4963.197051216:7fd16ef45700: strm 0x7fd1711ea280: file 8 read 0 bytes > 4963.197076670:7fd16ef45700: stream checking for file change on > '/var/log/nginx/error.log', inode 262240/262240 > 4963.197111945:7fd16ef45700: DDDD: imfile: enter into wdmap[4]: wd 5, dir > -1, file 2 > 4963.197131988:7fd16ef45700: DDDD: watch 5 added for file > /var/log/pts/pts-worker-1.log > > Many lines up is the output for file 1 (/var/log/nginx/access.log), which > looks pretty much identical to the file 2 (/var/log/nginx/error.log) > output. The last line of the output is for file 3, but the process dies > after that. If I comment out file 3 and 4 in the config, rsyslogd starts up > fine. So it seems like it won't do more than 2 files. I deleted the state > files trying to troubleshoot this, so I don't have those. > > > Config file: > > module(load="imfile" PollingInterval="1") > > # File 1 > input(type="imfile" File="/var/log/nginx/access.log" > Tag="nginx-access:" > StateFile="nginx-access" > Severity="info" > Facility="local7") > > # File 2 > input(type="imfile" File="/var/log/nginx/error.log" > Tag="nginx-error:" > StateFile="nginx-error" > Severity="error" > Facility="local7") > > # File 3 > input(type="imfile" File="/var/log/pts/pts-web-1.log" > Tag="pts-web-1:" > StateFile="pts-web-1" > Severity="info" > Facility="local7") > > # File 4 > input(type="imfile" File="/var/log/pts/pts-worker-1.log" > Tag="pts-worker-1" > StateFile="pts-worker-1" > Severity="info" > Facility="local7") > > > System info: > > Ubuntu 14.04 > > > rsyslog -v output: > > rsyslogd 8.2.1, compiled with: > FEATURE_REGEXP: Yes > FEATURE_LARGEFILE: No > GSSAPI Kerberos 5 support: No > FEATURE_DEBUG (debug build, slow code): No > 32bit Atomic operations supported: Yes > 64bit Atomic operations supported: Yes > memory allocator: jemalloc > Runtime Instrumentation (slow code): No > uuid support: Yes > Number of Bits in RainerScript integers: 64 > > > Thanks so much for any help with this! > -Alex > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
