Hi Asif, not sure your's and mine problem is same, but look like I had similar issue. I used to monitor catalina.out file of tomcat, but after log rotation runs of each day, the more logs stopped forwarding.
What I did was use a postroate action to delete the rsyslog stat file and restart the rsyslog, which did the trick. Thanks, Ashish -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Muhammad Asif Sent: Friday, April 22, 2016 3:28 AM To: rsyslog-users <[email protected]> Subject: [rsyslog] rsyslog issue with new modsec_audit.log Hi geeks, We are facing a problem with modsec_audit.log. Let me discuss a scenario. On start of a day modsecurity create a file with name modsec_audit.log. Throughout the day it contain 1000 logs which is sent by rsyslog to remote server. The next day modsecurity rename the previous file as modsec_audit.log.1 and create a new file modsec_audit.log. Now problem starts. Since fIlename is same so rsyslog pointer is stand at 1001 line. But first 1000 logs of next day do not process. How we can handle this issue. REgards M.Asif _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
