On Wed, 1 Jul 2015, [email protected] wrote:
Hi,
Unfortunately I identified that the logfile of impstats module does not get closed/reopened
after a "kill -HUP <rsyslog pid>".
For my point of view this is not the expected behaviour, because the man page
of rsyslogd says:
--------------------------------------------------------------------------------------------------------------------------------
SIGNALS
Rsyslogd reacts to a set of signals. You may easily send a signal to
rsyslogd using the following:
Note that -SIGNAL must be replaced with the actual signal you are trying
to send, e.g. with HUP. So it then becomes:
kill -HUP $(cat /var/run/rsyslogd.pid)
HUP This lets rsyslogd perform close all open files.
--------------------------------------------------------------------------------------------------------------------------------
My configuration looks like this:
Module (load="impstats" interval="30" severity="7" log.syslog="off"
log.file="/var/log/rsyslog.stats")
How to reproduce:
1. start rsyslogd
2. rename the log-file (or use logrotate) to /var/log/rsyslog.stats-old
3. send kill -HUP to PID
4. fuser /var/log/rsyslog.stats-old shows, file handle is used by rsyslogd
process, meanwhile file-handle of /var/log/rsyslogd.stats is not opened.
Does it make sense to open an issue on github for this?
probably.
I think that the reason it acts this way is that the file option for the
impstats module bypasses all the normal rsyslog handling. It's intended as a
failsafe.
If you instead do ruleset="pstats"
and then
ruleset(name="pstats" queue.type="fixedarray"){
/var/log/rsyslog.stats
}
you should end up with an independent queue for the pstats logs, so congestion
or other problems with other log messages won't affect the pstats logs, and
since the output is now using the standard tools, it will honor the HUP as you
expect.
The fact that the file option is such a backdoor hack to get data out even if
everything else is going wrong makes it so that adding the HUP processing is
much harder than you would think. This is why my reaction above is only
'probably' rather than 'yes' :-)
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
