On Thu, 16 Jun 2016, Alec Swan wrote:
Hello,
I am using imfile to read multiple log files in a folder using wildcards
and addMetadata="on" setting. Everything works fine and log files are being
read correctly until logrotate happens. Once logrotate runs rsyslog stops
reading log files until restarted.
Is there a way to make logrotate configuration more rsyslog friendly?
/var/log/myapp/logs/*.log {
daily
missingok
rotate 7
compress
notifempty
copytruncate
}
The problem is the copytruncate
When you copytruncate you are guaranteeing that you are going to loose some
logs, there is a race between when the copy completes and when everything in the
file is thrown away by the truncate, anything written to the logfile during this
time will be lost. Depending on how the app is writing the logs, the truncate
may even happen in the middle of a log message.
What you should do is mv the log and then trigger whatever is writing the log to
close the file and open a new file. Exactly how you do this depends on the app.
Restarting or huping rsyslog doesn't solve this problem, this is pure log loss
due to race conditions from the log rotation.
current versions of rsyslog should not have a problem noticing that the file was
truncated and needs to be re-read, as long as the file is smaller at the time
that it goes to read it after the truncation.
But if the file get moved instead, rsyslog will continue reading the old file to
the end, and then notice that the inode for the filename has changed (i.e. that
the move happened), and close the old file and start reading the new one.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
