MonitorWare Knowledge Base

Hi!

I have a problem with rsyslog not processing files in the spool directory. Occasionally, when I need to do DB maintenance on the MySQL DB, rsyslog will spool (as I think it should) to its spool directory:

[root@XXXXXXXX spool]# pwd
/opt/rsyslog/spool

-rw------- 1 root root 512000527 Jan 27 04:39 Pri5.00000005
-rw------- 1 root root 512000386 Jan 27 04:46 Pri5.00000006
-rw------- 1 root root 512000520 Jan 27 04:49 Pri4.00000004
-rw------- 1 root root 512001174 Jan 27 04:53 Pri5.00000007
-rw------- 1 root root 512000734 Jan 27 05:00 Pri4.00000005
-rw------- 1 root root 512000378 Jan 27 05:00 Pri5.00000008
-rw------- 1 root root 512001311 Jan 27 05:07 Pri5.00000009
-rw------- 1 root root 512000805 Jan 27 05:11 Pri4.00000006
-rw------- 1 root root 512001439 Jan 27 05:14 Pri5.00000010

However, once the database comes back online, these files are NEVER processed - they are now essentially orphaned. Is there any way to force processing of these files?

Here is my rsyslog version and config - any help would be appreciated!

rsyslogd 3.20.3, compiled with:
FEATURE_REGEXP: Yes
FEATURE_LARGEFILE: Yes
FEATURE_NETZIP (message compression): Yes
GSSAPI Kerberos 5 support: No
FEATURE_DEBUG (debug build, slow code): No
Runtime Instrumentation (slow code): No

$ModLoad ommysql.so # load the output driver (use ompgsql.so for PostgreSQL)
$ModLoad imudp.so # network reception
$ModLoad imtcp.so # network reception (TCP)
#$ModLoad imuxsock.so # local message reception
#$ModLoad imklog

# Our ports to listen on

$UDPServerRun 5140 # start a udp server at port 5140
$InputTCPServerRun 5140 # start a tcp server at port 5140
$UDPServerRun 514 # start a udp server at port 5140
$InputTCPServerRun 514 # start a tcp server at port 5140

# Discards



# End Discards


# These are the main queues - DO NOT CHANGE!


$template SEInsert,"insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values ('%msg%', '%syslogfacility%', '%HOSTNAME%', '%syslogpriority
%', '%timereported:::date-mysql%', '%timegenerated:::date-mysql%', '%iut%', '%syslogtag%')",sql

# Global spool

#$MainMsgQueueType LinkedList
#$MainMsgQueueType FixedArray
#$MainMsgQueueType Disk
$WorkDirectory /opt/rsyslog/spool
#$MainMsgQueueFileName mainq # set file name, also enables disk mode
#$MainMsgQueueWorkerThreadMinimumMessages 100
#$MainMsgQueueCheckpointInterval 3600
#$MainMsgQueueSaveOnShutdown on
#$MainMsgQueueMaxFileSize 2048000000
#$MainMsgQueueWorkerThreads 3

$ActionQueueType LinkedList # use asynchronous processing
$ActionQueueFileName Pri0 # set file name, also enables disk mode
$ActionQueueMaxFileSize 512000000
$ActionResumeRetryCount -1 # infinite retries on insert failure
:syslogpriority, isequal, "0" mmysql:DB-vip-priv,Pri0,rsyslog,xxx;SEInsert

$ActionQueueType LinkedList # use asynchronous processing
$ActionQueueFileName Pri1 # set file name, also enables disk mode
$ActionQueueMaxFileSize 512000000
$ActionResumeRetryCount -1 # infinite retries on insert failure
:syslogpriority, isequal, "1" mmysql:DB-vip-priv,Pri1,rsyslog,xxx;SEInsert

$ActionQueueType LinkedList # use asynchronous processing
$ActionQueueFileName Pri2 # set file name, also enables disk mode
$ActionQueueMaxFileSize 512000000
$ActionResumeRetryCount -1 # infinite retries on insert failure
:syslogpriority, isequal, "2" mmysql:DB-vip-priv,Pri2,rsyslog,xxx;SEInsert

$ActionQueueType LinkedList # use asynchronous processing
$ActionQueueFileName Pri3 # set file name, also enables disk mode
$ActionQueueMaxFileSize 512000000
$ActionResumeRetryCount -1 # infinite retries on insert failure
:syslogpriority, isequal, "3" mmysql:DB-vip-priv,Pri3,rsyslog,xxx;SEInsert

$ActionQueueType LinkedList # use asynchronous processing
$ActionQueueFileName Pri4 # set file name, also enables disk mode
$ActionQueueMaxFileSize 512000000
$ActionResumeRetryCount -1 # infinite retries on insert failure
:syslogpriority, isequal, "4" mmysql:DB-vip-priv,Pri4,rsyslog,xxx;SEInsert

$ActionQueueType LinkedList # use asynchronous processing
$ActionQueueFileName Pri5 # set file name, also enables disk mode
$ActionQueueMaxFileSize 512000000
$ActionResumeRetryCount -1 # infinite retries on insert failure
:syslogpriority, isequal, "5" mmysql:DB-vip-priv,Pri5,rsyslog,xxx;SEInsert

$ActionQueueType LinkedList # use asynchronous processing
$ActionQueueFileName Pri6 # set file name, also enables disk mode
$ActionQueueMaxFileSize 512000000
$ActionResumeRetryCount -1 # infinite retries on insert failure
:syslogpriority, isequal, "6" mmysql:DB-vip-priv,Pri6,rsyslog,xxx;SEInsert

$ActionQueueType LinkedList # use asynchronous processing
$ActionQueueFileName Pri7 # set file name, also enables disk mode
$ActionQueueMaxFileSize 512000000
$ActionResumeRetryCount -1 # infinite retries on insert failure
:syslogpriority, isequal, "7" mmysql:DB-vip-priv,Pri7,rsyslog,xxx;SEInsert

• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

can it be that these are left-overs from an abort? If not, I'd need a debug file from a run which leaves over some files.