On Thu, 16 Jun 2016, Alec Swan wrote:
Thanks, David. Neither HUPing rsyslog nor avoiding copytruncate are ideal
since they require the service that writes logs to know what to do, i.e.
either HUP after logrotate or reread the file node after copytruncate.
I am planning to go with HUP because it doesn't require changing the source
code of the logging library.
Ok, just be aware that you will loose some logs as they rotate.
what version of rsyslog are you running? current versions should not require a
HUP.
David Lang
Thanks,
Alec
On Thu, Jun 16, 2016 at 11:36 AM, David Lang <[email protected]> wrote:
On Thu, 16 Jun 2016, Alec Swan wrote:
Hello,
I am using imfile to read multiple log files in a folder using wildcards
and addMetadata="on" setting. Everything works fine and log files are
being
read correctly until logrotate happens. Once logrotate runs rsyslog stops
reading log files until restarted.
Is there a way to make logrotate configuration more rsyslog friendly?
/var/log/myapp/logs/*.log {
daily
missingok
rotate 7
compress
notifempty
copytruncate
}
The problem is the copytruncate
When you copytruncate you are guaranteeing that you are going to loose
some logs, there is a race between when the copy completes and when
everything in the file is thrown away by the truncate, anything written to
the logfile during this time will be lost. Depending on how the app is
writing the logs, the truncate may even happen in the middle of a log
message.
What you should do is mv the log and then trigger whatever is writing the
log to close the file and open a new file. Exactly how you do this depends
on the app.
Restarting or huping rsyslog doesn't solve this problem, this is pure log
loss due to race conditions from the log rotation.
current versions of rsyslog should not have a problem noticing that the
file was truncated and needs to be re-read, as long as the file is smaller
at the time that it goes to read it after the truncation.
But if the file get moved instead, rsyslog will continue reading the old
file to the end, and then notice that the inode for the filename has
changed (i.e. that the move happened), and close the old file and start
reading the new one.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
