Hello,
I was just testing an rsyslog 8.4.2 with our Logsene and I didn't
understand why I couldn't see no logs from the tailed files. The problem
seems to be that, with ReadMode set to 2, imfile doesn't pass events on no
matter what you put in the file.
I always see this in the debug log and nothing else:
3954.342512201:imfile.c : DDDD: imfile: wd 3 got file 1, dir -1
3954.342522434:imfile.c : strm 0x7fc6e00045b0: file 7 read 9 bytes
3954.342528353:imfile.c : strm 0x7fc6e00045b0: file 7 read 0 bytes
3954.342537453:imfile.c : stream checking for file change on
'/var/log/cassandra/system.log', inode 263735/263735
3962.854107352:imfile.c : DDDD: imfile event notification: rd 16[0],
wd (3, mask 00000002, cookie 0000, len 0)
3962.854124058:imfile.c : watch was MODIFID
For reference, here's a complete configuration that normally works with
Logsene:
module(load="imfile")
input(type="imfile"
File="/var/log/cassandra/system.log"
Tag="cassandra-system:"
StateFile="cassandra-system"
ReadMode="2")
*.* @@logsene-receiver-syslog.sematext.com;RSYSLOG_SyslogProtocol23Format
As soon as I set ReadMode to the default 0, things work as expected (logs
are forwarded all the way).
Does anyone else experience this issue? It may be recently introduced,
because I tested various versions and I never had this problem. And I was
always using ReadMode 2.
Best regards,
Radu
--
Performance Monitoring * Log Analytics * Search Analytics
Solr & Elasticsearch Support * http://sematext.com/
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
