On Thu, 1 Dec 2016, mosto...@gmail.com wrote:

Note that when $WorkDirectory is not set or set to a non-writable location, the state file **will not be generated**.

  Am I wrong or state files are written to / in this scenario?

no, without a work directory set, they don't get written to /. As the doc says, they just don't get written anywhere.
This is not what is happening on my tests. Setting WorkDirectory to non-existing directory make it create imfile-state on /. Just opened an issue.

slightly different than not setting it at all :-) good catch on this bug.

read modes other than 0 currently seem to have issues in inotify mode

  Any open issues? it's an based-on-experienced-warning message? legacy?

good question

imfile has tag, facility and severity properties...

  Is there any way this properties being /inherited/ for ALL modules?
  (hence documented on "/input-modules/")

no, because other input modules don't hard-code these values, they set them based on the message they receive. It doesn't make sense to have them apply to all modules.
I don't understand your reasoning here.
Why it makes sense to set tag when using imfile but not with imtcp?

all messages arriving via imtcp are supposed to be in rfc-3164 or rfc-5424, both of which set all these values.

imfile is the only input to let you set them, because it's the only input where you don't get the data from the log source. When you are reading data from arbitrary log files from a program, they don't have these properties in the file.

One drawback with imfile is that if the file has this data in it, it's hard to make use of it.

trimlineoverbytes should actually apply to all modes, why only to some?
I'm just a monkey typing...ask someone who knows!

is reopen on truncate really still experimental?
It was marked so...


David Lang
rsyslog mailing list
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 

Reply via email to