Thanks for the responses everyone! I happened to try using the legacy config directives to setup my imfile inputs and that worked as expected. It seems like the problem could be with the new style config.
Here's the full log with valgrind: http://pastebin.com/KTNVnnun On Sun, May 18, 2014 at 5:08 AM, Rainer Gerhards <[email protected]>wrote: > It's probably a bug. As David says, there is no limit on the nbr of files. > > It would be best if you could post the complete debug log, up to the point > where it dies. It would be even better if you could run it under valgrind > > $ sudo valgrind -log-fd=1 rsyslogd -dn > combined_log > > and post that log. > > Rainer > > > On Sun, May 18, 2014 at 10:19 AM, David Lang <[email protected]> wrote: > > > I'm not aware of any problems with fewer than a couple hundred imfiles > > (and that was a compile time variable that I think was recently changed > to > > be unlimited) > > > > could you check earlier in the debug output to see if there is any other > > mention of these files? > > > > do all the files exist and have content at the time rsyslog starts? > > > > David Lang > > > > > > > > On Sun, 18 May 2014, Alex Bird wrote: > > > > Hello, > >> > >> I'm trying to configure rsyslog to collect logs for a web application > >> using > >> the imfile module. I only have 4 imfile inputs configured, but rsyslogd > >> won't start unless I only have 2 at the most. If I run 'sudo rsyslogd > >> -dn', > >> the tail of the output looks like this: > >> > >> 4963.196879382:7fd16ef45700: main Q: qqueueAdd: entry added, size now > log > >> 69, phys 72 entries > >> 4963.196889949:7fd16ef45700: main Q: qqueueAdd: entry added, size now > log > >> 70, phys 73 entries > >> 4963.196901182:7fd16ef45700: main Q: MultiEnqObj advised worker start > >> 4963.196919437:7fd16ef45700: DDDD: imfile: enter into wdmap[3]: wd 4, > dir > >> -1, file 1 > >> 4963.196931055:7fd16ef45700: DDDD: watch 4 added for file > >> /var/log/nginx/error.log > >> 4963.196951059:7fd16ef45700: imfile: increased dir table to 4 entries > >> 4963.196962765:7fd16ef45700: DDDD: associated file > >> 1[/var/log/nginx/error.log] to directory 0[/var/log/nginx] > >> 4963.196977470:7fd16ef45700: filemon 0x7fd1710d8278: clean startup, no > .si > >> file found > >> 4963.196990293:7fd16ef45700: file stream /var/log/nginx/error.log > params: > >> flush interval 0, async write 0 > >> 4963.197009221:7fd16ef45700: file '/var/log/nginx/error.log' opened as > #8 > >> with mode 384 > >> 4963.197026642:7fd16ef45700: strm 0x7fd1711ea280: opened file > >> '/var/log/nginx/error.log' for READ as 8 > >> 4963.197051216:7fd16ef45700: strm 0x7fd1711ea280: file 8 read 0 bytes > >> 4963.197076670:7fd16ef45700: stream checking for file change on > >> '/var/log/nginx/error.log', inode 262240/262240 > >> 4963.197111945:7fd16ef45700: DDDD: imfile: enter into wdmap[4]: wd 5, > dir > >> -1, file 2 > >> 4963.197131988:7fd16ef45700: DDDD: watch 5 added for file > >> /var/log/pts/pts-worker-1.log > >> > >> Many lines up is the output for file 1 (/var/log/nginx/access.log), > which > >> looks pretty much identical to the file 2 (/var/log/nginx/error.log) > >> output. The last line of the output is for file 3, but the process dies > >> after that. If I comment out file 3 and 4 in the config, rsyslogd starts > >> up > >> fine. So it seems like it won't do more than 2 files. I deleted the > state > >> files trying to troubleshoot this, so I don't have those. > >> > >> > >> Config file: > >> > >> module(load="imfile" PollingInterval="1") > >> > >> # File 1 > >> input(type="imfile" File="/var/log/nginx/access.log" > >> Tag="nginx-access:" > >> StateFile="nginx-access" > >> Severity="info" > >> Facility="local7") > >> > >> # File 2 > >> input(type="imfile" File="/var/log/nginx/error.log" > >> Tag="nginx-error:" > >> StateFile="nginx-error" > >> Severity="error" > >> Facility="local7") > >> > >> # File 3 > >> input(type="imfile" File="/var/log/pts/pts-web-1.log" > >> Tag="pts-web-1:" > >> StateFile="pts-web-1" > >> Severity="info" > >> Facility="local7") > >> > >> # File 4 > >> input(type="imfile" File="/var/log/pts/pts-worker-1.log" > >> Tag="pts-worker-1" > >> StateFile="pts-worker-1" > >> Severity="info" > >> Facility="local7") > >> > >> > >> System info: > >> > >> Ubuntu 14.04 > >> > >> > >> rsyslog -v output: > >> > >> rsyslogd 8.2.1, compiled with: > >> FEATURE_REGEXP: Yes > >> FEATURE_LARGEFILE: No > >> GSSAPI Kerberos 5 support: No > >> FEATURE_DEBUG (debug build, slow code): No > >> 32bit Atomic operations supported: Yes > >> 64bit Atomic operations supported: Yes > >> memory allocator: jemalloc > >> Runtime Instrumentation (slow code): No > >> uuid support: Yes > >> Number of Bits in RainerScript integers: 64 > >> > >> > >> Thanks so much for any help with this! > >> -Alex > >> _______________________________________________ > >> rsyslog mailing list > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > >> http://www.rsyslog.com/professional-services/ > >> What's up with rsyslog? Follow https://twitter.com/rgerhards > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > >> DON'T LIKE THAT. > >> > >> _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
