I think you need to set workdir.
David Lang
On Wed, 13 Apr 2016, Joan wrote:
Date: Wed, 13 Apr 2016 08:51:03 +0200
From: Joan <[email protected]>
Reply-To: rsyslog-users <[email protected]>
To: rsyslog-users <[email protected]>
Subject: Re: [rsyslog] Files being resent with imfile module on system reboot
I didn't specify the workdir variable, I am using the ubuntu ppa, and just
using the sane default. I overlooked the PersistStateInterval, it surely
will mitigate the issue whenever it repeats.
I'll try to see if I can reproduce the behaviour with the shutdown again
(it's a production system and I can reboot normally)
Thanks a lot
2016-04-12 18:44 GMT+02:00 David Lang <[email protected]>:
On Tue, 12 Apr 2016, Joan wrote:
The files are properly created under /var/spool/rsyslog, unfortunately the
timestamp of the file is from the last restart I did. The only strange
thing I see, is that apparently rsyslog wasn't notified of the shutdown
(ntpd and others left a message).
so this is your workdir?
It could be that rsyslog is taking too long to shutdown, and so it gets
sent a kill -9 and doesn't get a chance to shutdown cleanly.
Also, according to
http://www.rsyslog.com/doc/v8-stable/configuration/modules/imfile.html
PersistStateInterval defaults to 0, so the file is only created at
shutdown. If you set it to some non-zero size, it will write the file every
X lines, so you won't replay the entire file. I would set this at several
hundred to a few thousand to make the overhead of writing the file
negligable.
David Lang
Once the boot finished, the ony information rsyslog left was the following
Apr 12 09:02:43 WEBER rsyslogd: [origin software="rsyslogd"
swVersion="8.17.0" x-pid="410" x-info="http://www.rsyslog.com";] start
Apr 12 09:02:43 WEBER rsyslogd-2007: action 'action 16' suspended, next
retry is Tue Apr 12 09:03:13 2016 [v8.17.0 try
http://www.rsyslog.com/e/2007
]
Apr 12 09:02:43 WEBER rsyslogd-2307: warning: ~ action is deprecated,
consider using the 'stop' statement instead [v8.17.0 try
http://www.rsyslog.com/e/2307 ]
Apr 12 09:02:43 WEBER rsyslogd: rsyslogd's groupid changed to 104
Apr 12 09:02:43 WEBER rsyslogd: rsyslogd's userid changed to 101
Apr 12 09:03:58 WEBER rsyslogd-2359: action 'action 16' resumed (module
'builtin:omfwd') [v8.17.0 try http://www.rsyslog.com/e/2359 ]
Apr 12 09:03:58 WEBER rsyslogd-2359: action 'action 16' resumed (module
'builtin:omfwd') [v8.17.0 try http://www.rsyslog.com/e/2359 ]
The only related config I have is this one, it's already with the new
syntax, after researching I believed it was ok this way
module(load="imfile"
mode="inotify"
)
input(type="imfile"
File="/opt/process/log/*.log"
Tag="taskproject:"
Facility="local3"
)
2016-04-12 11:21 GMT+02:00 David Lang <[email protected]>:
what you need to look at is the state file for the file as part of the
imfile section.
This is probably much clearer with the new syntax available in v7+
David Lang
On Tue, 12 Apr 2016, Joan wrote:
Date: Tue, 12 Apr 2016 09:56:07 +0200
From: Joan <[email protected]>
Reply-To: rsyslog-users <[email protected]>
To: rsyslog-users <[email protected]>
Subject: [rsyslog] Files being resent with imfile module on system
reboot
Hello,
I am using rsyslog with imfile module to send the contents of a few .log
files. I have configured the queue like this:
$ActionQueueFileName resender
$ActionResumeRetryCount -1
$ActionQueueSaveOnShutdown on
Whenever I restart rsyslog, it will know at which point where the logs,
and
follow from there. The issue is only after rebooting the server. In this
case it just flushed all the logs again to the central collector.
Did I miss something?
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
