On Tue, 12 Apr 2016, Joan wrote:
The files are properly created under /var/spool/rsyslog, unfortunately the
timestamp of the file is from the last restart I did. The only strange
thing I see, is that apparently rsyslog wasn't notified of the shutdown
(ntpd and others left a message).
so this is your workdir?
It could be that rsyslog is taking too long to shutdown, and so it gets sent a
kill -9 and doesn't get a chance to shutdown cleanly.
Also, according to
http://www.rsyslog.com/doc/v8-stable/configuration/modules/imfile.html
PersistStateInterval defaults to 0, so the file is only created at shutdown. If
you set it to some non-zero size, it will write the file every X lines, so you
won't replay the entire file. I would set this at several hundred to a few
thousand to make the overhead of writing the file negligable.
David Lang
Once the boot finished, the ony information rsyslog left was the following
Apr 12 09:02:43 WEBER rsyslogd: [origin software="rsyslogd"
swVersion="8.17.0" x-pid="410" x-info="http://www.rsyslog.com";] start
Apr 12 09:02:43 WEBER rsyslogd-2007: action 'action 16' suspended, next
retry is Tue Apr 12 09:03:13 2016 [v8.17.0 try http://www.rsyslog.com/e/2007
]
Apr 12 09:02:43 WEBER rsyslogd-2307: warning: ~ action is deprecated,
consider using the 'stop' statement instead [v8.17.0 try
http://www.rsyslog.com/e/2307 ]
Apr 12 09:02:43 WEBER rsyslogd: rsyslogd's groupid changed to 104
Apr 12 09:02:43 WEBER rsyslogd: rsyslogd's userid changed to 101
Apr 12 09:03:58 WEBER rsyslogd-2359: action 'action 16' resumed (module
'builtin:omfwd') [v8.17.0 try http://www.rsyslog.com/e/2359 ]
Apr 12 09:03:58 WEBER rsyslogd-2359: action 'action 16' resumed (module
'builtin:omfwd') [v8.17.0 try http://www.rsyslog.com/e/2359 ]
The only related config I have is this one, it's already with the new
syntax, after researching I believed it was ok this way
module(load="imfile"
mode="inotify"
)
input(type="imfile"
File="/opt/process/log/*.log"
Tag="taskproject:"
Facility="local3"
)
2016-04-12 11:21 GMT+02:00 David Lang <[email protected]>:
what you need to look at is the state file for the file as part of the
imfile section.
This is probably much clearer with the new syntax available in v7+
David Lang
On Tue, 12 Apr 2016, Joan wrote:
Date: Tue, 12 Apr 2016 09:56:07 +0200
From: Joan <[email protected]>
Reply-To: rsyslog-users <[email protected]>
To: rsyslog-users <[email protected]>
Subject: [rsyslog] Files being resent with imfile module on system reboot
Hello,
I am using rsyslog with imfile module to send the contents of a few .log
files. I have configured the queue like this:
$ActionQueueFileName resender
$ActionResumeRetryCount -1
$ActionQueueSaveOnShutdown on
Whenever I restart rsyslog, it will know at which point where the logs,
and
follow from there. The issue is only after rebooting the server. In this
case it just flushed all the logs again to the central collector.
Did I miss something?
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
