2014-10-17 17:28 GMT+02:00 Radu Gheorghe <[email protected]>:
> Hi Rainer, > > Thanks, you're right. With polling more it works well. I'd still prefer > inotify, though, because it plays nicely with logrotate. > > There are a couple of patches for inotify mode inside the git branch, and I am currently working on wildcard support, so there is more to come. As usual, nobody used inotify, until it became default in stable, so we are seing these issues now ;) Rainer > Best regards, > Radu > -- > Performance Monitoring * Log Analytics * Search Analytics > Solr & Elasticsearch Support * http://sematext.com/ > > On Fri, Oct 17, 2014 at 3:44 PM, Rainer Gerhards <[email protected] > > > wrote: > > > could you check if that's an incompatibility with inotify mode. To do so, > > just add > > > > mode="polling" > > > > to the module definition. > > > > Rainer > > > > 2014-10-17 13:32 GMT+02:00 Radu Gheorghe <[email protected]>: > > > > > Hello, > > > > > > I was just testing an rsyslog 8.4.2 with our Logsene and I didn't > > > understand why I couldn't see no logs from the tailed files. The > problem > > > seems to be that, with ReadMode set to 2, imfile doesn't pass events on > > no > > > matter what you put in the file. > > > > > > I always see this in the debug log and nothing else: > > > > > > 3954.342512201:imfile.c : DDDD: imfile: wd 3 got file 1, dir -1 > > > 3954.342522434:imfile.c : strm 0x7fc6e00045b0: file 7 read 9 > bytes > > > 3954.342528353:imfile.c : strm 0x7fc6e00045b0: file 7 read 0 > bytes > > > 3954.342537453:imfile.c : stream checking for file change on > > > '/var/log/cassandra/system.log', inode 263735/263735 > > > 3962.854107352:imfile.c : DDDD: imfile event notification: rd > > 16[0], > > > wd (3, mask 00000002, cookie 0000, len 0) > > > 3962.854124058:imfile.c : watch was MODIFID > > > > > > For reference, here's a complete configuration that normally works with > > > Logsene: > > > > > > module(load="imfile") > > > > > > input(type="imfile" > > > File="/var/log/cassandra/system.log" > > > Tag="cassandra-system:" > > > StateFile="cassandra-system" > > > ReadMode="2") > > > > > > *.* @@logsene-receiver-syslog.sematext.com > > ;RSYSLOG_SyslogProtocol23Format > > > > > > As soon as I set ReadMode to the default 0, things work as expected > (logs > > > are forwarded all the way). > > > > > > Does anyone else experience this issue? It may be recently introduced, > > > because I tested various versions and I never had this problem. And I > was > > > always using ReadMode 2. > > > > > > Best regards, > > > Radu > > > -- > > > Performance Monitoring * Log Analytics * Search Analytics > > > Solr & Elasticsearch Support * http://sematext.com/ > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com/professional-services/ > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > myriad > > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > > DON'T LIKE THAT. > > > > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
