Nice, I'll give it a try. Thanks,
Alec On Thu, Jun 16, 2016 at 4:02 PM, David Lang <[email protected]> wrote: > looking at: > http://www.rsyslog.com/doc/v8-stable/configuration/modules/imfile.html > > did you try the reopenOnTruncate option? > > David Lang > > > On Thu, 16 Jun 2016, Alec Swan wrote: > > I am using rsyslog version 8.19. It did require restart (I haven't tried >> HUP yet) after logrotate, but I wonder if that's because I am using >> wildcards *.log in imfile plugin. >> >> Thanks, >> >> Alec >> >> On Thu, Jun 16, 2016 at 3:05 PM, David Lang <[email protected]> wrote: >> >> On Thu, 16 Jun 2016, Alec Swan wrote: >>> >>> Thanks, David. Neither HUPing rsyslog nor avoiding copytruncate are ideal >>> >>>> since they require the service that writes logs to know what to do, i.e. >>>> either HUP after logrotate or reread the file node after copytruncate. >>>> >>>> I am planning to go with HUP because it doesn't require changing the >>>> source >>>> code of the logging library. >>>> >>>> >>> Ok, just be aware that you will loose some logs as they rotate. >>> >>> what version of rsyslog are you running? current versions should not >>> require a HUP. >>> >>> David Lang >>> >>> >>> Thanks, >>> >>>> >>>> Alec >>>> >>>> On Thu, Jun 16, 2016 at 11:36 AM, David Lang <[email protected]> wrote: >>>> >>>> On Thu, 16 Jun 2016, Alec Swan wrote: >>>> >>>>> >>>>> Hello, >>>>> >>>>> >>>>>> I am using imfile to read multiple log files in a folder using >>>>>> wildcards >>>>>> and addMetadata="on" setting. Everything works fine and log files are >>>>>> being >>>>>> read correctly until logrotate happens. Once logrotate runs rsyslog >>>>>> stops >>>>>> reading log files until restarted. >>>>>> >>>>>> Is there a way to make logrotate configuration more rsyslog friendly? >>>>>> >>>>>> /var/log/myapp/logs/*.log { >>>>>> daily >>>>>> missingok >>>>>> rotate 7 >>>>>> compress >>>>>> notifempty >>>>>> copytruncate >>>>>> } >>>>>> >>>>>> >>>>>> The problem is the copytruncate >>>>> >>>>> When you copytruncate you are guaranteeing that you are going to loose >>>>> some logs, there is a race between when the copy completes and when >>>>> everything in the file is thrown away by the truncate, anything written >>>>> to >>>>> the logfile during this time will be lost. Depending on how the app is >>>>> writing the logs, the truncate may even happen in the middle of a log >>>>> message. >>>>> >>>>> What you should do is mv the log and then trigger whatever is writing >>>>> the >>>>> log to close the file and open a new file. Exactly how you do this >>>>> depends >>>>> on the app. >>>>> >>>>> Restarting or huping rsyslog doesn't solve this problem, this is pure >>>>> log >>>>> loss due to race conditions from the log rotation. >>>>> >>>>> current versions of rsyslog should not have a problem noticing that the >>>>> file was truncated and needs to be re-read, as long as the file is >>>>> smaller >>>>> at the time that it goes to read it after the truncation. >>>>> >>>>> But if the file get moved instead, rsyslog will continue reading the >>>>> old >>>>> file to the end, and then notice that the inode for the filename has >>>>> changed (i.e. that the move happened), and close the old file and start >>>>> reading the new one. >>>>> >>>>> David Lang >>>>> >>>>> _______________________________________________ >>>>> rsyslog mailing list >>>>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>>>> http://www.rsyslog.com/professional-services/ >>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a >>>>> myriad >>>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>>>> DON'T LIKE THAT. >>>>> >>>>> _______________________________________________ >>>>> >>>> rsyslog mailing list >>>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>>> http://www.rsyslog.com/professional-services/ >>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>>> DON'T LIKE THAT. >>>> >>>> _______________________________________________ >>>> >>> rsyslog mailing list >>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>> http://www.rsyslog.com/professional-services/ >>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>> DON'T LIKE THAT. >>> >>> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> >> _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
