On Sat, 8 Sep 2018, eSX via rsyslog wrote:
Hi all
Recently I use imfile to process logs.
I want to delete logs after reading by rsyslog.
But it seems there is no proper method to know if a file has been read to
the end?
For example, the logs divided by hours, new message in this hour won’t be
appended to previous hour. So the old log would be a read only one. I can
remove the old one after it finished by rsyslog.
Fortunately, the state file described the offset of file processing, but
it’s not timely because of PersistStateInterval. I can set it to “1” but
it’s too expensive.
So is there any cheaper method? Or can I notify imfile to sync the state
file(e.g. send a signal)?
Currently imfile doesn't have any way of doing this. It setup for the more
common case where one program is writing to the file while rsyslog is reading
from the file, so it expects more data to be written.
You can enable metadata for the file what will show how far into the file it is,
you may be able to do something with sending that data to an external script
and it look at the file size to decide that rsyslog has finished with the file.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
