There were numerous changes to imfile. I suggest to go to the currently supported 8.12.0. If the problem persists, we can look into it.
Rainer 2015-08-26 8:58 GMT+02:00 C. L. Martinez <[email protected]>: > Hi all, > > I am using a rsyslog instance to forward some logs to a third server > and I have detected a strange behavior (host is a Debian 8.1 fully > patched). > > I am doing some tests to forward only two log files: > > input(type="imfile" file="/nsm/logs/idpsuricata01/fast.log" > tag="suricata" statefile="stat-suricata" facility="local6" > severity="info") > input(type="imfile" file="/nsm/logs/idpsuricata01/http.log" tag="url" > statefile="stat-url" facility="local6" severity="info") > > Output is defined as: > > if $syslogtag == 'suricata' then { > action(type="omfwd" protocol="tcp" target="172.17.22.1" port="10514" > template="suricata01_rfc5424fmt" > queue.filename="suricatafwd" > queue.maxdiskspace="1g" > queue.saveonshutdown="on" > queue.type="linkedlist" > queue.maxfilesize="5m" > action.resumeretrycount="-1") > stop > } > > if $syslogtag == 'url' then { > action(type="omfwd" protocol="tcp" target="172.17.22.1" port="10514" > template="url_rfc5424fmt" > queue.filename="urlfwd" > queue.maxdiskspace="4g" > queue.saveonshutdown="on" > queue.type="linkedlist" > queue.maxfilesize="5m" > action.resumeretrycount="-1") > stop > } > > Now, my problem: http.log is correctly forwarded but fast.log not. > > Any reason?? Debugging rsyslog config I don't see any wrong ... > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
