I have a program that generates a lot of individual log files and I am using rsyslog to process these into a single log file which I then monitor with a third-party application. I have gone through the manual regarding the imfile module and understand how I can configure it to use the inotify API or set it to polling mode. I currently have imfile to use inotify, but because (to my understanding) this continuously monitors files, the more files are generated, the more file watches are produced which then at some point hit the limit listed under /proc/sys/fs/inotify/max_user_watches.
I know I could increase this limit, I know I could have cron jobs continuously remove these generated log files on short intervals (less than a week), but what I'm wondering is, *is there a way in the rsyslog configuration to read a file once, generate a state file, and never look at it again?* Thanks, ABB _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
