On Fri, 30 Dec 2016, Dmitriy Kalinin wrote:
On Dec 30, 2016, at 1:14 PM, David Lang <[email protected]> wrote:
On Fri, 30 Dec 2016, Dmitriy Kalinin via rsyslog wrote:
one alternative to above approach is to keep on reloading rsyslog every x
seconds while rewriting rsyslog config to include all found nested
directories within one directory. this feels somewhat wrong given that
imfile seems to lean towards wildcard support (just current impl is
limited). aside from feeling a bit awkward are there any downsides to
reloading rsyslog every x seconds (of course we can add some kind of config
file hashing to see if reload is necessary -- not sure if rsyslog already
does that by default)? will reload interfere with loaded forwarding rules
for existing files (especially if files are being logrotated at the same
time)?
The first thing would be to check if a full restart is needed or if a HUP is
enough.
A full restart can take a noticable amount of time, and can cause you to
loose messages because rsyslog wasn't listening (especially with UDP, but
also with TCP)
yup sighup is the way to go, but im not sure if that causes any interruption
to the system. any thoughts on if frequent sighup-ing (lets say every 5 secs)
would affect rsyslog significantly?
it depends on your outputs. A HUP is pretty cheap in general, but if you have
outputs that require connections to authenticated databases across a
high-latency network, it can make it fairly expensieve
so your issue is that the directories that you want rsyslog to watch don't
exist at the time rsyslog is started, correct?
right. for example:
/logs - exists
/logs/foo.log - matches wildcard
/logs/new-dir/new-subdir/bar.log - added after start
it sounds like what you are looking for is
https://github.com/rsyslog/rsyslog/issues/1280
though much simpler. only need to specify ideally /logs/**/*.log and rsyslog
would pick up all nested files and rescan.
the headache with that is the number of inotify registrations that could be
needed, but that's also in the enhancement request queue.
David Lang
k
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
