Remember that with readmode != 0, rsyslog needs to see the start of the next log
message before it can be sure that the prior one has finished. So you have to
have it reading a file with more than one message in it.
What does the file you are realing look like?
David Lang
On Fri, 17 Oct 2014,
Radu Gheorghe wrote:
Date: Fri, 17 Oct 2014 14:32:10 +0300
From: Radu Gheorghe <[email protected]>
Reply-To: rsyslog-users <[email protected]>
To: rsyslog-users <[email protected]>
Subject: [rsyslog] not forwarding when imfile has readmode=2
Hello,
I was just testing an rsyslog 8.4.2 with our Logsene and I didn't
understand why I couldn't see no logs from the tailed files. The problem
seems to be that, with ReadMode set to 2, imfile doesn't pass events on no
matter what you put in the file.
I always see this in the debug log and nothing else:
3954.342512201:imfile.c : DDDD: imfile: wd 3 got file 1, dir -1
3954.342522434:imfile.c : strm 0x7fc6e00045b0: file 7 read 9 bytes
3954.342528353:imfile.c : strm 0x7fc6e00045b0: file 7 read 0 bytes
3954.342537453:imfile.c : stream checking for file change on
'/var/log/cassandra/system.log', inode 263735/263735
3962.854107352:imfile.c : DDDD: imfile event notification: rd 16[0],
wd (3, mask 00000002, cookie 0000, len 0)
3962.854124058:imfile.c : watch was MODIFID
For reference, here's a complete configuration that normally works with
Logsene:
module(load="imfile")
input(type="imfile"
File="/var/log/cassandra/system.log"
Tag="cassandra-system:"
StateFile="cassandra-system"
ReadMode="2")
*.* @@logsene-receiver-syslog.sematext.com;RSYSLOG_SyslogProtocol23Format
As soon as I set ReadMode to the default 0, things work as expected (logs
are forwarded all the way).
Does anyone else experience this issue? It may be recently introduced,
because I tested various versions and I never had this problem. And I was
always using ReadMode 2.
Best regards,
Radu
--
Performance Monitoring * Log Analytics * Search Analytics
Solr & Elasticsearch Support * http://sematext.com/
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
