Dear Ashish, Thanks for reply. How you did this exactally. Any cron job or some thing else?
Regards M.Asif On Fri, Apr 22, 2016 at 10:08 PM, Ashish Barmase < [email protected]> wrote: > Hi Asif, not sure your's and mine problem is same, but look like I had > similar issue. I used to monitor catalina.out file of tomcat, but after log > rotation runs of each day, the more logs stopped forwarding. > > What I did was use a postroate action to delete the rsyslog stat file and > restart the rsyslog, which did the trick. > > Thanks, > Ashish > > -----Original Message----- > From: [email protected] [mailto: > [email protected]] On Behalf Of Muhammad Asif > Sent: Friday, April 22, 2016 3:28 AM > To: rsyslog-users <[email protected]> > Subject: [rsyslog] rsyslog issue with new modsec_audit.log > > Hi geeks, > > We are facing a problem with modsec_audit.log. Let me discuss a scenario. > On start of a day modsecurity create a file with name modsec_audit.log. > Throughout the day it contain 1000 logs which is sent by rsyslog to remote > server. > The next day modsecurity rename the previous file as modsec_audit.log.1 > and create a new file modsec_audit.log. Now problem starts. Since fIlename > is same so rsyslog pointer is stand at 1001 line. But first 1000 logs of > next day do not process. > > How we can handle this issue. > > REgards > M.Asif > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: > This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites > beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE > THAT. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
