For some weeks there are a lot of closing logfile notification via inotify seen on one syslog relay running rsyslog 8.1901 version.
The messages like these May 4 15:10:04 fwd01 iWatch[31831]: * /chroot/local/var/log/h1/local-all.log is closed May 4 15:10:04 fwd01 iWatch[31831]: * /chroot/local/var/log/h3/haproxy.log is closed May 4 15:10:04 fwd01 iWatch[31831]: * /chroot/local/var/log/h1/haproxy.log is closed May 4 15:10:04 fwd01 iWatch[31831]: * /chroot/local/var/log/h5/nginx-site-access.log is closed May 4 15:10:04 fwd01 iWatch[31831]: * /chroot/local/var/log/h1/apache-site-error.log is closed May 4 15:10:04 fwd01 iWatch[31831]: * /chroot/local/var/log/h1/apache-site-access.log is closed are seen. With simple check of top -p PID I see that the thread PIDs of omfile are changing more times in second. Seems the logfiles are just updated. After restarting the instance, the situation is solved. The issue is maybe caused by logrotation job. Seems this bug is hit https://github.com/rsyslog/rsyslog/blob/master/ChangeLog#L533 Is there any way to prove it somehow? In that case would like to open bug report at Debian to make an patch backport to 8.1901 version which is Debian10 base. Peter _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
