The files are properly created under /var/spool/rsyslog, unfortunately the timestamp of the file is from the last restart I did. The only strange thing I see, is that apparently rsyslog wasn't notified of the shutdown (ntpd and others left a message).
Once the boot finished, the ony information rsyslog left was the following Apr 12 09:02:43 WEBER rsyslogd: [origin software="rsyslogd" swVersion="8.17.0" x-pid="410" x-info="http://www.rsyslog.com";] start Apr 12 09:02:43 WEBER rsyslogd-2007: action 'action 16' suspended, next retry is Tue Apr 12 09:03:13 2016 [v8.17.0 try http://www.rsyslog.com/e/2007 ] Apr 12 09:02:43 WEBER rsyslogd-2307: warning: ~ action is deprecated, consider using the 'stop' statement instead [v8.17.0 try http://www.rsyslog.com/e/2307 ] Apr 12 09:02:43 WEBER rsyslogd: rsyslogd's groupid changed to 104 Apr 12 09:02:43 WEBER rsyslogd: rsyslogd's userid changed to 101 Apr 12 09:03:58 WEBER rsyslogd-2359: action 'action 16' resumed (module 'builtin:omfwd') [v8.17.0 try http://www.rsyslog.com/e/2359 ] Apr 12 09:03:58 WEBER rsyslogd-2359: action 'action 16' resumed (module 'builtin:omfwd') [v8.17.0 try http://www.rsyslog.com/e/2359 ] The only related config I have is this one, it's already with the new syntax, after researching I believed it was ok this way module(load="imfile" mode="inotify" ) input(type="imfile" File="/opt/process/log/*.log" Tag="taskproject:" Facility="local3" ) 2016-04-12 11:21 GMT+02:00 David Lang <[email protected]>: > what you need to look at is the state file for the file as part of the > imfile section. > > This is probably much clearer with the new syntax available in v7+ > > David Lang > > On Tue, 12 Apr 2016, Joan wrote: > > Date: Tue, 12 Apr 2016 09:56:07 +0200 >> From: Joan <[email protected]> >> Reply-To: rsyslog-users <[email protected]> >> To: rsyslog-users <[email protected]> >> Subject: [rsyslog] Files being resent with imfile module on system reboot >> >> >> Hello, >> >> I am using rsyslog with imfile module to send the contents of a few .log >> files. I have configured the queue like this: >> >> $ActionQueueFileName resender >> $ActionResumeRetryCount -1 >> $ActionQueueSaveOnShutdown on >> >> Whenever I restart rsyslog, it will know at which point where the logs, >> and >> follow from there. The issue is only after rebooting the server. In this >> case it just flushed all the logs again to the central collector. >> Did I miss something? >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> >> _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
