Thanks, David. Neither HUPing rsyslog nor avoiding copytruncate are ideal since they require the service that writes logs to know what to do, i.e. either HUP after logrotate or reread the file node after copytruncate.
I am planning to go with HUP because it doesn't require changing the source code of the logging library. Thanks, Alec On Thu, Jun 16, 2016 at 11:36 AM, David Lang <[email protected]> wrote: > On Thu, 16 Jun 2016, Alec Swan wrote: > > Hello, >> >> I am using imfile to read multiple log files in a folder using wildcards >> and addMetadata="on" setting. Everything works fine and log files are >> being >> read correctly until logrotate happens. Once logrotate runs rsyslog stops >> reading log files until restarted. >> >> Is there a way to make logrotate configuration more rsyslog friendly? >> >> /var/log/myapp/logs/*.log { >> daily >> missingok >> rotate 7 >> compress >> notifempty >> copytruncate >> } >> > > The problem is the copytruncate > > When you copytruncate you are guaranteeing that you are going to loose > some logs, there is a race between when the copy completes and when > everything in the file is thrown away by the truncate, anything written to > the logfile during this time will be lost. Depending on how the app is > writing the logs, the truncate may even happen in the middle of a log > message. > > What you should do is mv the log and then trigger whatever is writing the > log to close the file and open a new file. Exactly how you do this depends > on the app. > > Restarting or huping rsyslog doesn't solve this problem, this is pure log > loss due to race conditions from the log rotation. > > current versions of rsyslog should not have a problem noticing that the > file was truncated and needs to be re-read, as long as the file is smaller > at the time that it goes to read it after the truncation. > > But if the file get moved instead, rsyslog will continue reading the old > file to the end, and then notice that the inode for the filename has > changed (i.e. that the move happened), and close the old file and start > reading the new one. > > David Lang > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
