If this is still in the works, may I provide a suggestion? Two cases that come to mind where log files in a directory do not grow may be due to the source of those files only using those files for a set period of time before generating a new one or that the source rollovers logs regardless of the existence of messages in the current iteration. In rsyslog these two cases could be implemented as an expiration time since modification time and as an "upload" (read -> close -> delete, or an extended behavior where state files are generated so files are not erased by rsyslog).
So if you were configuring an input using RainerScript it could look like this: input( type="imfile" File="/path/to/dir/or/file" Tag="someApp" ruleset="custom_rules" upload="on" ***OR*** expire="60" # in minutes ) My two cents on a possible expansion of current behavior. As to my original question, I'll increase the current maximum for file watches and run cron jobs to delete these temporary log files. Thank you! -ABB On Sat, May 23, 2020 at 1:16 PM Rainer Gerhards via rsyslog < [email protected]> wrote: > I think I also said this on the issue tracker, but: what is the > predicate to stop watching the file? No activity for"n" hours? > > Rainer > > El sáb., 23 may. 2020 a las 19:07, John Chivian via rsyslog > (<[email protected]>) escribió: > > > > Not currently, no. There is an open request to read a file, then close > > and delete. It was entered for the case of log files that are moved > > into a watched directory and never grow. > > > > Regards, > > > > > > On 5/23/20 11:39 AM, Anthony Benitez Borges via rsyslog wrote: > > > I have a program that generates a lot of individual log files and I am > > > using rsyslog to process these into a single log file which I then > monitor > > > with a third-party application. I have gone through the manual > regarding > > > the imfile module and understand how I can configure it to use the > inotify > > > API or set it to polling mode. I currently have imfile to use inotify, > but > > > because (to my understanding) this continuously monitors files, the > more > > > files are generated, the more file watches are produced which then at > some > > > point hit the limit listed under /proc/sys/fs/inotify/max_user_watches. > > > > > > I know I could increase this limit, I know I could have cron jobs > > > continuously remove these generated log files on short intervals (less > than > > > a week), but what I'm wondering is, *is there a way in the rsyslog > > > configuration to read a file once, generate a state file, and never > look at > > > it again?* > > > > > > Thanks, > > > ABB > > > _______________________________________________ > > > rsyslog mailing list > > > https://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com/professional-services/ > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if > you DON'T LIKE THAT. > > > > > > _______________________________________________ > > rsyslog mailing list > > https://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ > rsyslog mailing list > https://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
