Page 1 of 1

Only one log source survives a rotation

PostPosted: Thu Oct 20, 2016 7:57 pm
by davemckenna01
Hi, I'm encountering strange behaviour with Rsyslog + imfile where logs from the first file being monitored (/var/services/log_test/test1/log/main/current) continue to be read after a rotation, but logs from the second do not. If I reorder the config blocks below to have the test2 version in the first spot, then the test2 logs survive a rotation and test1's do not. So it seems that the order of the input() blocks matters.

----------------------------
/etc/rsyslog.conf:
----------------------------

module(load="imfile" PollingInterval="10")

input(type="imfile"
File="/var/services/log_test/test1/log/main/current"
Tag="test1"
StateFile="/var/spool/rsyslog/test1-statefile"
Severity="notice"
Facility="local1")

input(type="imfile"
File="/var/services/log_test/test2/log/main/current"
Tag="test2"
StateFile="/var/spool/rsyslog/test2-statefile"
Severity="notice"
Facility="local1")
...

---------------------------------------------------

Both of these log sources have the same format of data, and both are rotated roughly every minute.

Any ideas why this is happening?