I'm not aware of any problems with fewer than a couple hundred imfiles (and that
was a compile time variable that I think was recently changed to be unlimited)
could you check earlier in the debug output to see if there is any other mention
of these files?
do all the files exist and have content at the time rsyslog starts?
David Lang
On Sun, 18 May 2014, Alex Bird wrote:
Hello,
I'm trying to configure rsyslog to collect logs for a web application using
the imfile module. I only have 4 imfile inputs configured, but rsyslogd
won't start unless I only have 2 at the most. If I run 'sudo rsyslogd -dn',
the tail of the output looks like this:
4963.196879382:7fd16ef45700: main Q: qqueueAdd: entry added, size now log
69, phys 72 entries
4963.196889949:7fd16ef45700: main Q: qqueueAdd: entry added, size now log
70, phys 73 entries
4963.196901182:7fd16ef45700: main Q: MultiEnqObj advised worker start
4963.196919437:7fd16ef45700: DDDD: imfile: enter into wdmap[3]: wd 4, dir
-1, file 1
4963.196931055:7fd16ef45700: DDDD: watch 4 added for file
/var/log/nginx/error.log
4963.196951059:7fd16ef45700: imfile: increased dir table to 4 entries
4963.196962765:7fd16ef45700: DDDD: associated file
1[/var/log/nginx/error.log] to directory 0[/var/log/nginx]
4963.196977470:7fd16ef45700: filemon 0x7fd1710d8278: clean startup, no .si
file found
4963.196990293:7fd16ef45700: file stream /var/log/nginx/error.log params:
flush interval 0, async write 0
4963.197009221:7fd16ef45700: file '/var/log/nginx/error.log' opened as #8
with mode 384
4963.197026642:7fd16ef45700: strm 0x7fd1711ea280: opened file
'/var/log/nginx/error.log' for READ as 8
4963.197051216:7fd16ef45700: strm 0x7fd1711ea280: file 8 read 0 bytes
4963.197076670:7fd16ef45700: stream checking for file change on
'/var/log/nginx/error.log', inode 262240/262240
4963.197111945:7fd16ef45700: DDDD: imfile: enter into wdmap[4]: wd 5, dir
-1, file 2
4963.197131988:7fd16ef45700: DDDD: watch 5 added for file
/var/log/pts/pts-worker-1.log
Many lines up is the output for file 1 (/var/log/nginx/access.log), which
looks pretty much identical to the file 2 (/var/log/nginx/error.log)
output. The last line of the output is for file 3, but the process dies
after that. If I comment out file 3 and 4 in the config, rsyslogd starts up
fine. So it seems like it won't do more than 2 files. I deleted the state
files trying to troubleshoot this, so I don't have those.
Config file:
module(load="imfile" PollingInterval="1")
# File 1
input(type="imfile" File="/var/log/nginx/access.log"
Tag="nginx-access:"
StateFile="nginx-access"
Severity="info"
Facility="local7")
# File 2
input(type="imfile" File="/var/log/nginx/error.log"
Tag="nginx-error:"
StateFile="nginx-error"
Severity="error"
Facility="local7")
# File 3
input(type="imfile" File="/var/log/pts/pts-web-1.log"
Tag="pts-web-1:"
StateFile="pts-web-1"
Severity="info"
Facility="local7")
# File 4
input(type="imfile" File="/var/log/pts/pts-worker-1.log"
Tag="pts-worker-1"
StateFile="pts-worker-1"
Severity="info"
Facility="local7")
System info:
Ubuntu 14.04
rsyslog -v output:
rsyslogd 8.2.1, compiled with:
FEATURE_REGEXP: Yes
FEATURE_LARGEFILE: No
GSSAPI Kerberos 5 support: No
FEATURE_DEBUG (debug build, slow code): No
32bit Atomic operations supported: Yes
64bit Atomic operations supported: Yes
memory allocator: jemalloc
Runtime Instrumentation (slow code): No
uuid support: Yes
Number of Bits in RainerScript integers: 64
Thanks so much for any help with this!
-Alex
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
