I didn't specify the workdir variable, I am using the ubuntu ppa, and just using the sane default. I overlooked the PersistStateInterval, it surely will mitigate the issue whenever it repeats. I'll try to see if I can reproduce the behaviour with the shutdown again (it's a production system and I can reboot normally)
Thanks a lot 2016-04-12 18:44 GMT+02:00 David Lang <[email protected]>: > On Tue, 12 Apr 2016, Joan wrote: > > The files are properly created under /var/spool/rsyslog, unfortunately the >> timestamp of the file is from the last restart I did. The only strange >> thing I see, is that apparently rsyslog wasn't notified of the shutdown >> (ntpd and others left a message). >> > > so this is your workdir? > > It could be that rsyslog is taking too long to shutdown, and so it gets > sent a kill -9 and doesn't get a chance to shutdown cleanly. > > Also, according to > http://www.rsyslog.com/doc/v8-stable/configuration/modules/imfile.html > PersistStateInterval defaults to 0, so the file is only created at > shutdown. If you set it to some non-zero size, it will write the file every > X lines, so you won't replay the entire file. I would set this at several > hundred to a few thousand to make the overhead of writing the file > negligable. > > David Lang > > > Once the boot finished, the ony information rsyslog left was the following >> >> Apr 12 09:02:43 WEBER rsyslogd: [origin software="rsyslogd" >> swVersion="8.17.0" x-pid="410" x-info="http://www.rsyslog.com";] start >> Apr 12 09:02:43 WEBER rsyslogd-2007: action 'action 16' suspended, next >> retry is Tue Apr 12 09:03:13 2016 [v8.17.0 try >> http://www.rsyslog.com/e/2007 >> ] >> Apr 12 09:02:43 WEBER rsyslogd-2307: warning: ~ action is deprecated, >> consider using the 'stop' statement instead [v8.17.0 try >> http://www.rsyslog.com/e/2307 ] >> Apr 12 09:02:43 WEBER rsyslogd: rsyslogd's groupid changed to 104 >> Apr 12 09:02:43 WEBER rsyslogd: rsyslogd's userid changed to 101 >> Apr 12 09:03:58 WEBER rsyslogd-2359: action 'action 16' resumed (module >> 'builtin:omfwd') [v8.17.0 try http://www.rsyslog.com/e/2359 ] >> Apr 12 09:03:58 WEBER rsyslogd-2359: action 'action 16' resumed (module >> 'builtin:omfwd') [v8.17.0 try http://www.rsyslog.com/e/2359 ] >> >> >> The only related config I have is this one, it's already with the new >> syntax, after researching I believed it was ok this way >> module(load="imfile" >> mode="inotify" >> ) >> input(type="imfile" >> File="/opt/process/log/*.log" >> Tag="taskproject:" >> Facility="local3" >> ) >> >> >> >> 2016-04-12 11:21 GMT+02:00 David Lang <[email protected]>: >> >> what you need to look at is the state file for the file as part of the >>> imfile section. >>> >>> This is probably much clearer with the new syntax available in v7+ >>> >>> David Lang >>> >>> On Tue, 12 Apr 2016, Joan wrote: >>> >>> Date: Tue, 12 Apr 2016 09:56:07 +0200 >>> >>>> From: Joan <[email protected]> >>>> Reply-To: rsyslog-users <[email protected]> >>>> To: rsyslog-users <[email protected]> >>>> Subject: [rsyslog] Files being resent with imfile module on system >>>> reboot >>>> >>>> >>>> Hello, >>>> >>>> I am using rsyslog with imfile module to send the contents of a few .log >>>> files. I have configured the queue like this: >>>> >>>> $ActionQueueFileName resender >>>> $ActionResumeRetryCount -1 >>>> $ActionQueueSaveOnShutdown on >>>> >>>> Whenever I restart rsyslog, it will know at which point where the logs, >>>> and >>>> follow from there. The issue is only after rebooting the server. In this >>>> case it just flushed all the logs again to the central collector. >>>> Did I miss something? >>>> _______________________________________________ >>>> rsyslog mailing list >>>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>>> http://www.rsyslog.com/professional-services/ >>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>>> DON'T LIKE THAT. >>>> >>>> _______________________________________________ >>>> >>> rsyslog mailing list >>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>> http://www.rsyslog.com/professional-services/ >>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>> DON'T LIKE THAT. >>> >>> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> >> _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
