Hallo, I'm developing a webapp Java, which logs to a rolling file using log4j-2. The logged file(s) are later forwarded with rsyslog to 2 actions: 'omfwd' to a Splunk server and 'omprog'.
I've been executing the high load tests on the webapp, and once they finish I've realized that on both destinations are more logs than in files. And these duplicated logs are the first(s) line(s) of the rolled files. When trying to activate rsyslog with debug[1], doesn't send all the logs from the original files then. I've published a simpler example[2] which reproduces almost all the times the issue. Is a Java application which can be run with gradle inside a docker container. There is also a Splunk server runnable with docker, in the same repo. Can be a rsyslog rolling detection issue? Thanks, [1]: http://www.rsyslog.com/doc/v8-stable/troubleshooting/debug.html [2]: https://github.com/lucasvc/rsyslog-tests/tree/master/log4j2-rollover -- Lucas _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
