Hi everyone,
I've found an issue where I'm reading a file with imfile (catalina.out) and
I've seen it get into a loop where it keeps rereading the file in a loop, and
keeps transferring the content repeatedly until I stop rsyslog. I haven't been
able to recreate the issue, but I have ran into it a few times now. It's
looped so many times it takes a file that is originally a few hundred megs and
makes it 700+ gigs on the destination server. The other thing I'm noticing is
the state files on the imfile keep piling up. I thought those were supposed to
be reused, but it looks like it's writing new files constantly.
My imfile and ruleset are below. Any help/comments/suggestions would be
appreciated.
ruleset(name="Rule-catalina"){
action(
Target="monvsyslog.na.lzb.hq"
port="1531"
queue.filename="FWD-catalina-monvsyslog.na.lzb.hq-1531"
name="fwd-catalina-monvsyslog.na.lzb.hq-1531"
protocol="tcp"
type="omfwd"
TCP_Framing="octet-counted"
queue.size="25000"
queue.discardmark="20000"
queue.dequeuebatchsize="1024"
queue.type="LinkedList"
queue.spoolDirectory="/var/spool/rsyslog-imfile"
queue.saveOnShutdown="on"
queue.maxDiskSpace="1g"
)
stop
}
input(type="imfile"
file="/var/log/tomcat6/catalina.out"
tag="catalina:"
facility="local6"
PersistStateInterval="100"
ruleset="Rule-catalina"
reopenOnTruncate="on"
discardTruncatedMsg="on"
)
Scot Kreienkamp | Senior Systems Engineer | La-Z-Boy Corporate
One La-Z-Boy Drive | Monroe, Michigan 48162 | * 734-384-6403 | | * 7349151444
| * [email protected]<mailto:%7BE-mail%7D>
www<http://www.la-z-boy.com/>.la-z-boy.com<http://www.la-z-boy.com/> |
facebook.<https://www.facebook.com/lazboy>com<https://www.facebook.com/lazboy>/<https://www.facebook.com/lazboy>lazboy<http://facebook.com/lazboy>
| twitter.com/lazboy<https://twitter.com/lazboy> |
youtube.com/<https://www.youtube.com/user/lazboy>lazboy<https://www.youtube.com/user/lazboy>
[cid:lzbVertical_hres.jpg]
This message is intended only for the individual or entity to which it is
addressed. It may contain privileged, confidential information which is exempt
from disclosure under applicable laws. If you are not the intended recipient,
you are strictly prohibited from disseminating or distributing this information
(other than to the intended recipient) or copying this information. If you
have received this communication in error, please notify us immediately by
e-mail or by telephone at the above number. Thank you.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
