Well, with this logrotate setup the file should not get copied and
truncated but moved. Do you have copytruncate as a default rotate mode?
Have you verified the inode numbers on log files?
From
https://www.rsyslog.com/doc/v8-stable/configuration/modules/imfile.html -
"The file monitor supports file rotation. To fully work, rsyslogd must
run while the file is rotated. Then, any remaining lines from the old
file are read and processed and when done with that, the new file is
being processed from the beginning. If rsyslogd is stopped during
rotation, the new file is read, but any not-yet-reported lines from the
previous file can no longer be obtained."
On 01.09.2021 04:07, S&A Hullick via rsyslog wrote:
Hi,
I have rsyslog set up to forward logs to a separate log repository on
another server and have some files that stop forwarding after log rotate.
My issue is that the log file itself is copied to a separate file and
then emptied (truncated). Then, of course, rsyslog doesn't forward
until the size of the log file reaches the number in the imfile-state
file.
Can someone please suggest a setup where the state file will be
zeroed. My current configs for rsyslog and logrotate are as follows:
rsyslog:
rsyslogd: version 8.24.0-41.el7_7.2, config validation run (level 1),
master config /etc/rsyslog.conf
$InputFileName /var/log/httpd/access.log
$InputFileTag httpd_access:
$InputFileStateFile stats-httpd_access
$InputFileFacility local6
$InputRunFileMonitor
Logrotate (daily cycle):
"/var/log/httpd/access.log" {
weekly
create 640 root root
missingok
notifempty
sharedscripts
delaycompress
postrotate
/bin/systemctl reload httpd.service > /dev/null 2>/dev/null ||
true
endscript
}
at present, after logrotate, I need to stop the rsyslogd, manually
zero the imfile-state file and restart rsyslogd. The log file will
then start being forwarded to the log server.
Kind regards,
Andrew.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
