Are these logs all local? or are some of them from remote machines?
do you have any disk queueing setup?your example shows a corrupted log (where you have stuff combined into a log messae as opposed to a separate log message), this could be a result of the known problems with json-c. could you show your full config?
David Lang On Thu, 5 May 2016, Kuo Hugo wrote:
Date: Thu, 5 May 2016 01:28:38 +0800 From: Kuo Hugo <[email protected]> Reply-To: rsyslog-users <[email protected]> To: [email protected] Subject: [rsyslog] [Log delayed] Some old logs appears in the log file Hi Folks, I observed a weird behaviour with rsyslog. In the following logs, you can find a line is the log of 8 hours ago. This issue appears occasionally. Around 10 times per-day. And some old logs are more days ago. # grep from /var/log/swift/all.log # May 4 09:59:59 cloud-paco02 object-updater: Object update sweep of d32 completed: 0.03s, 0 successes, 0 failures May 4 09:59:59 cloud-paco02 object-updater: Object update sweep of d30 completed: 0.02s, 0 successes, 0 failures May 4 09:59:59 cloud-paco02 object-updater: Object update sweep completed: 0.46sMay 4 02:02:08 cloud-paco02 object-updater: Object update sweep of d31 completed: 0.00s, 0 successes, 0 failures May 4 10:04:59 cloud-paco02 object-updater: Begin object update sweep May 4 10:04:59 cloud-paco02 object-updater: Object update sweep of d31 completed: 0.00s, 0 successes, 0 failures May 4 10:04:59 cloud-paco02 object-updater: Object update sweep of d32 completed: 0.00s, 0 successes, 0 failures - Our daemons send log to the unix domain socket (/dev/log) - Rsyslog version - 7.4.4-1ubuntu2.6 [ Confs ] The log facilities are local0 and local2 from our daemons. local2.* /var/log/swift/proxy_access.log;RSYSLOG_FileFormat local0.*;local2.* /var/log/swift/all.log;RSYSLOG_TraditionalFileFormat & ~ Here’s gist link of the /etc/rsyslog.conf https://gist.github.com/HugoKuo/1bc7a61c87dafb2c9c7bd9bf792148fc - Any recommendation would be great. - I suspect the old logs are buffered somewhere - Is there a way to dump all those buffered log? - I believe it’s nothing about out daemon since I restarted our processes but the old log is still showing up. - I have four servers in this situation. Thanks // Hugo _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
