Unfortunately, reopenOnTruncate="on" did not work. In fact, rsyslog process was dead this morning and I wasn't able to track any errors in /var/log/messages that would explain why the process died. So, I am reverting back to HUPing rsyslog.
Thanks, Alec On Thu, Jun 16, 2016 at 4:21 PM, Alec Swan <[email protected]> wrote: > Nice, I'll give it a try. > > Thanks, > > Alec > > On Thu, Jun 16, 2016 at 4:02 PM, David Lang <[email protected]> wrote: > >> looking at: >> http://www.rsyslog.com/doc/v8-stable/configuration/modules/imfile.html >> >> did you try the reopenOnTruncate option? >> >> David Lang >> >> >> On Thu, 16 Jun 2016, Alec Swan wrote: >> >> I am using rsyslog version 8.19. It did require restart (I haven't tried >>> HUP yet) after logrotate, but I wonder if that's because I am using >>> wildcards *.log in imfile plugin. >>> >>> Thanks, >>> >>> Alec >>> >>> On Thu, Jun 16, 2016 at 3:05 PM, David Lang <[email protected]> wrote: >>> >>> On Thu, 16 Jun 2016, Alec Swan wrote: >>>> >>>> Thanks, David. Neither HUPing rsyslog nor avoiding copytruncate are >>>> ideal >>>> >>>>> since they require the service that writes logs to know what to do, >>>>> i.e. >>>>> either HUP after logrotate or reread the file node after copytruncate. >>>>> >>>>> I am planning to go with HUP because it doesn't require changing the >>>>> source >>>>> code of the logging library. >>>>> >>>>> >>>> Ok, just be aware that you will loose some logs as they rotate. >>>> >>>> what version of rsyslog are you running? current versions should not >>>> require a HUP. >>>> >>>> David Lang >>>> >>>> >>>> Thanks, >>>> >>>>> >>>>> Alec >>>>> >>>>> On Thu, Jun 16, 2016 at 11:36 AM, David Lang <[email protected]> wrote: >>>>> >>>>> On Thu, 16 Jun 2016, Alec Swan wrote: >>>>> >>>>>> >>>>>> Hello, >>>>>> >>>>>> >>>>>>> I am using imfile to read multiple log files in a folder using >>>>>>> wildcards >>>>>>> and addMetadata="on" setting. Everything works fine and log files are >>>>>>> being >>>>>>> read correctly until logrotate happens. Once logrotate runs rsyslog >>>>>>> stops >>>>>>> reading log files until restarted. >>>>>>> >>>>>>> Is there a way to make logrotate configuration more rsyslog friendly? >>>>>>> >>>>>>> /var/log/myapp/logs/*.log { >>>>>>> daily >>>>>>> missingok >>>>>>> rotate 7 >>>>>>> compress >>>>>>> notifempty >>>>>>> copytruncate >>>>>>> } >>>>>>> >>>>>>> >>>>>>> The problem is the copytruncate >>>>>> >>>>>> When you copytruncate you are guaranteeing that you are going to loose >>>>>> some logs, there is a race between when the copy completes and when >>>>>> everything in the file is thrown away by the truncate, anything >>>>>> written >>>>>> to >>>>>> the logfile during this time will be lost. Depending on how the app is >>>>>> writing the logs, the truncate may even happen in the middle of a log >>>>>> message. >>>>>> >>>>>> What you should do is mv the log and then trigger whatever is writing >>>>>> the >>>>>> log to close the file and open a new file. Exactly how you do this >>>>>> depends >>>>>> on the app. >>>>>> >>>>>> Restarting or huping rsyslog doesn't solve this problem, this is pure >>>>>> log >>>>>> loss due to race conditions from the log rotation. >>>>>> >>>>>> current versions of rsyslog should not have a problem noticing that >>>>>> the >>>>>> file was truncated and needs to be re-read, as long as the file is >>>>>> smaller >>>>>> at the time that it goes to read it after the truncation. >>>>>> >>>>>> But if the file get moved instead, rsyslog will continue reading the >>>>>> old >>>>>> file to the end, and then notice that the inode for the filename has >>>>>> changed (i.e. that the move happened), and close the old file and >>>>>> start >>>>>> reading the new one. >>>>>> >>>>>> David Lang >>>>>> >>>>>> _______________________________________________ >>>>>> rsyslog mailing list >>>>>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>>>>> http://www.rsyslog.com/professional-services/ >>>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a >>>>>> myriad >>>>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>>>>> DON'T LIKE THAT. >>>>>> >>>>>> _______________________________________________ >>>>>> >>>>> rsyslog mailing list >>>>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>>>> http://www.rsyslog.com/professional-services/ >>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a >>>>> myriad >>>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>>>> DON'T LIKE THAT. >>>>> >>>>> _______________________________________________ >>>>> >>>> rsyslog mailing list >>>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>>> http://www.rsyslog.com/professional-services/ >>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>>> DON'T LIKE THAT. >>>> >>>> _______________________________________________ >>> rsyslog mailing list >>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>> http://www.rsyslog.com/professional-services/ >>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>> DON'T LIKE THAT. >>> >>> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> > > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
