Only one log source survives a rotation

General discussions here

Moderator: rgerhards

Google Ads


Only one log source survives a rotation

Postby davemckenna01 » Thu Oct 20, 2016 7:57 pm

Hi, I'm encountering strange behaviour with Rsyslog + imfile where logs from the first file being monitored (/var/services/log_test/test1/log/main/current) continue to be read after a rotation, but logs from the second do not. If I reorder the config blocks below to have the test2 version in the first spot, then the test2 logs survive a rotation and test1's do not. So it seems that the order of the input() blocks matters.

----------------------------
/etc/rsyslog.conf:
----------------------------

module(load="imfile" PollingInterval="10")

input(type="imfile"
File="/var/services/log_test/test1/log/main/current"
Tag="test1"
StateFile="/var/spool/rsyslog/test1-statefile"
Severity="notice"
Facility="local1")

input(type="imfile"
File="/var/services/log_test/test2/log/main/current"
Tag="test2"
StateFile="/var/spool/rsyslog/test2-statefile"
Severity="notice"
Facility="local1")
...

---------------------------------------------------

Both of these log sources have the same format of data, and both are rotated roughly every minute.

Any ideas why this is happening?
davemckenna01
New
 
Posts: 1
Joined: Thu Oct 20, 2016 7:44 pm

Urgent Question?

  • Pulling out your Hair?
  • Wasting Time and Money?
  • Deadline Approaching?

Google Ads


Return to General

Who is online

Users browsing this forum: No registered users and 2 guests

cron