IIRC, we had such an issue a year or two, three ago (which I think is the timeframe for that version). I would suggest to upgrade to the current version and check if the issue persists.
Rainer Sent from phone, thus brief. Am 04.05.2016 19:36 schrieb "David Lang" <[email protected]>: > Are these logs all local? or are some of them from remote machines? > > do you have any disk queueing setup? > > your example shows a corrupted log (where you have stuff combined into a > log messae as opposed to a separate log message), this could be a result of > the known problems with json-c. could you show your full config? > > David Lang > > On Thu, 5 May 2016, Kuo Hugo wrote: > > Date: Thu, 5 May 2016 01:28:38 +0800 >> From: Kuo Hugo <[email protected]> >> Reply-To: rsyslog-users <[email protected]> >> To: [email protected] >> Subject: [rsyslog] [Log delayed] Some old logs appears in the log file >> >> Hi Folks, >> >> I observed a weird behaviour with rsyslog. In the following logs, you can >> find a line is the log of 8 hours ago. This issue appears occasionally. >> Around 10 times per-day. And some old logs are more days ago. >> >> # grep from /var/log/swift/all.log # >> May 4 09:59:59 cloud-paco02 object-updater: Object update sweep of >> d32 completed: 0.03s, 0 successes, 0 failures >> May 4 09:59:59 cloud-paco02 object-updater: Object update sweep of >> d30 completed: 0.02s, 0 successes, 0 failures >> May 4 09:59:59 cloud-paco02 object-updater: Object update sweep >> completed: 0.46sMay 4 02:02:08 cloud-paco02 object-updater: Object >> update sweep of d31 completed: 0.00s, 0 successes, 0 failures >> May 4 10:04:59 cloud-paco02 object-updater: Begin object update sweep >> May 4 10:04:59 cloud-paco02 object-updater: Object update sweep of >> d31 completed: 0.00s, 0 successes, 0 failures >> May 4 10:04:59 cloud-paco02 object-updater: Object update sweep of >> d32 completed: 0.00s, 0 successes, 0 failures >> >> >> - Our daemons send log to the unix domain socket (/dev/log) >> - Rsyslog version - 7.4.4-1ubuntu2.6 >> >> [ Confs ] >> >> The log facilities are local0 and local2 from our daemons. >> >> local2.* /var/log/swift/proxy_access.log;RSYSLOG_FileFormat >> >> local0.*;local2.* /var/log/swift/all.log;RSYSLOG_TraditionalFileFormat >> & ~ >> >> Here’s gist link of the /etc/rsyslog.conf >> https://gist.github.com/HugoKuo/1bc7a61c87dafb2c9c7bd9bf792148fc >> >> - Any recommendation would be great. >> - I suspect the old logs are buffered somewhere >> - Is there a way to dump all those buffered log? >> - I believe it’s nothing about out daemon since I restarted our >> processes but the old log is still showing up. >> - I have four servers in this situation. >> >> Thanks // Hugo >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
