I could also see a provision for 'rename' rather than delete
David Lang
On Sat, 23 May 2020, John Chivian via rsyslog wrote:
Date: Sat, 23 May 2020 13:38:39 -0500
From: John Chivian via rsyslog <[email protected]>
To: [email protected]
Cc: John Chivian <[email protected]>
Subject: Re: [rsyslog] How to configure imfile to read a file once and stop
watching?
To Rainer's question, in my case there is no tracking time. When EOF is
encountered, the file would be closed and deleted. As mentioned, the
case is for files moved into a watched directory. A "mv" operation
within the same file system involves no "file" activity, only a the
transfer of a directory entry that points to already existing blocks of
data. Read to the end and done.
If the user could specify a tracking time, I would think that...
expire="0"
...would mean "immediate EOF close and delete" as described as above, and...
expire="-1"
...would mean "never expire" as is the current rsyslog behavior, and...
expire="60"
...would mean "watch for 60 intervals" (as suggested below).
Thanks and regards,
On 5/23/20 12:38 PM, Anthony Benitez Borges via rsyslog wrote:
If this is still in the works, may I provide a suggestion?
Two cases that come to mind where log files in a directory do not grow may
be due to the source of those files only using those files for a set
period of time before generating a new one or that the source rollovers
logs regardless of the existence of messages in the current iteration. In
rsyslog these two cases could be implemented as an expiration time since
modification time and as an "upload" (read -> close -> delete, or an
extended behavior where state files are generated so files are not erased
by rsyslog).
So if you were configuring an input using RainerScript it could look like
this:
input(
type="imfile"
File="/path/to/dir/or/file"
Tag="someApp"
ruleset="custom_rules"
upload="on"
***OR***
expire="60" # in minutes
)
My two cents on a possible expansion of current behavior.
As to my original question, I'll increase the current maximum for file
watches and run cron jobs to delete these temporary log files.
Thank you!
-ABB
On Sat, May 23, 2020 at 1:16 PM Rainer Gerhards via rsyslog <
[email protected]> wrote:
I think I also said this on the issue tracker, but: what is the
predicate to stop watching the file? No activity for"n" hours?
Rainer
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
