Re: [rsyslog] imfile read looping
That would likely explain it, and the randomness of it. I did note that when I had problems the only way to resolve it was to rotate the source logfile. With Tomcat and most java apps the only way to rotate the logs is to use copytruncate. Otherwise it quits writing the log. I can live with it until the next release now that I'm aware of it. Thanks for the info. Scot Kreienkamp |Senior Systems Engineer | La-Z-Boy Corporate One La-Z-Boy Drive| Monroe, Michigan 48162 | Office: 734-384-6403 | | Mobile: 7349151444 | Email: scot.kreienk...@la-z-boy.com > -Original Message- > From: rsyslog [mailto:rsyslog-boun...@lists.adiscon.com] On Behalf Of David > Lang > Sent: Monday, November 19, 2018 2:23 PM > To: rsyslog-users > Subject: Re: [rsyslog] imfile read looping > > There is a known problem in the current release with a large file size (4G > IIRC, > but it could be 2G) and truncation detection turned on. > > If there is any way to avoid using truncation detection by rotating the log > instead of truncating it, that is a far better option. > > I believe that the fix is in the daily build and will be in the next release. > > David Lang > ___ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. This message is intended only for the individual or entity to which it is addressed. It may contain privileged, confidential information which is exempt from disclosure under applicable laws. If you are not the intended recipient, you are strictly prohibited from disseminating or distributing this information (other than to the intended recipient) or copying this information. If you have received this communication in error, please notify us immediately by e-mail or by telephone at the above number. Thank you. ___ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: [rsyslog] imfile read looping
There is a known problem in the current release with a large file size (4G IIRC, but it could be 2G) and truncation detection turned on. If there is any way to avoid using truncation detection by rotating the log instead of truncating it, that is a far better option. I believe that the fix is in the daily build and will be in the next release. David Lang ___ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
[rsyslog] imfile read looping
Hi everyone,
I've found an issue where I'm reading a file with imfile (catalina.out) and
I've seen it get into a loop where it keeps rereading the file in a loop, and
keeps transferring the content repeatedly until I stop rsyslog. I haven't been
able to recreate the issue, but I have ran into it a few times now. It's
looped so many times it takes a file that is originally a few hundred megs and
makes it 700+ gigs on the destination server. The other thing I'm noticing is
the state files on the imfile keep piling up. I thought those were supposed to
be reused, but it looks like it's writing new files constantly.
My imfile and ruleset are below. Any help/comments/suggestions would be
appreciated.
ruleset(name="Rule-catalina"){
action(
Target="monvsyslog.na.lzb.hq"
port="1531"
queue.filename="FWD-catalina-monvsyslog.na.lzb.hq-1531"
name="fwd-catalina-monvsyslog.na.lzb.hq-1531"
protocol="tcp"
type="omfwd"
TCP_Framing="octet-counted"
queue.size="25000"
queue.discardmark="2"
queue.dequeuebatchsize="1024"
queue.type="LinkedList"
queue.spoolDirectory="/var/spool/rsyslog-imfile"
queue.saveOnShutdown="on"
queue.maxDiskSpace="1g"
)
stop
}
input(type="imfile"
file="/var/log/tomcat6/catalina.out"
tag="catalina:"
facility="local6"
PersistStateInterval="100"
ruleset="Rule-catalina"
reopenOnTruncate="on"
discardTruncatedMsg="on"
)
Scot Kreienkamp | Senior Systems Engineer | La-Z-Boy Corporate
One La-Z-Boy Drive | Monroe, Michigan 48162 | * 734-384-6403 | | * 7349151444
| * scot.kreienk...@la-z-boy.com
wwwcom/lazboy
| twitter.com/lazboy |
youtube.com/lazboy
[cid:lzbVertical_hres.jpg]
This message is intended only for the individual or entity to which it is
addressed. It may contain privileged, confidential information which is exempt
from disclosure under applicable laws. If you are not the intended recipient,
you are strictly prohibited from disseminating or distributing this information
(other than to the intended recipient) or copying this information. If you
have received this communication in error, please notify us immediately by
e-mail or by telephone at the above number. Thank you.
___
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
