2016-05-25 8:22 GMT+02:00 Thomas Güttler <[email protected]>: > Am 24.05.2016 um 17:40 schrieb Rainer Gerhards: >> >> 2016-05-24 17:10 GMT+02:00 Thomas Güttler <[email protected]>: >>> >>> Hi, >>> >>> I have some remote hosts which can't connect to our central host. >>> >>> Up to now we do dirty file based fetching of log files. >>> >>> This has a major draw back: >>> >>> - If logrotate runs, then some lines could get lost. >> >> >> If you first move the file and only after that HUP rsyslogd, no lines >> will get lost. The other way around can loose messages. Rsyslog keeps >> the fd open (fd != file name) until HUP, so will write to the moved >> files until HUP. > > > Yes, I am sure, that rsyslog won't loose a single line if you rotate like > you describe it. > > But since the logs get fetched, not pushed, I can't synchronise the > fetch and rotate process. ... ok, it could be synchronised, but > this makes things complicated.
Probaly I misunderstand what you mean by "fetched". I assumed that you a) send logs to rsyslog b) rsyslog writes them to a file c) you HUP rsyslog d) you fetch the file (after HUP and maybe a decent wait) Do you mean that - rsyslog reads logs via imfile? That shouldn't change the picture. - you continously rsync the log files while rsyslog is writing to it? If they latter, I don't know enough about rsync to know if it understands file movements. I guess no. The question then is why you don't forward logs via syslog to another rsyslog instance. Rainer > > I think the file based fetching (via rsync) don't really work. > > On the other hand I would like to avoid to add a new system like > apache nifi .... > > Please tell me, if you see a simple solution. > > Thank you, > > > Thomas Güttler > > > -- > Thomas Guettler http://www.thomas-guettler.de/ > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
