Page 1 of 1

rsyslog - stopped logging even service is running on server!

PostPosted: Tue Sep 03, 2013 8:19 am
by pallav
Hello,

I've implemented a central rsyslog logging system in one of my project. In that one linux box is running rsyslog server and another is client which sends log information to rsyslog server.
The setup is perfectly working fine when I restart the rsyslog service on the server. But in next day when I check the rsyslog server, It has stopped logging. To troubleshoot the problem I checked following status on rsyslog server:-

[root@FlashPool1 logs]# service rsyslog status
rsyslogd (pid 10325) is running...



[root@FlashPool1 logs]# netstat -tapn
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1483/sshd
tcp 0 0 0.0.0.0:514 0.0.0.0:* LISTEN 8918/rsyslogd
tcp 0 0 10.171.20.1:514 10.171.20.2:52300 ESTABLISHED 8918/rsyslogd
tcp 0 0 10.171.20.1:514 10.114.41.8:60207 ESTABLISHED 8918/rsyslogd


In this case rsyslog has already established the connection and listening tcp port but logs are not collecting and storing in specified log file although linux box's receiving tcp packets (Packets captured using tcpdump).

The surprising thing is to me that when I restart rsyslog service on server ( which is already running) It starts collecting and storing logs in log file.

My question is: Whey do we need to restart rsyslog service on server side each day for log collection although it is running?

Can you please look into this problem. Please let me know in case any other information required.

Thanks in advance!

Regards,
Pallav Gupta

Re: rsyslog - stopped logging even service is running on ser

PostPosted: Tue Sep 03, 2013 10:24 am
by pallav
Problem is solved now! Basically this problem had been raising from logrotate side.
I change the rsyslog logrotate config file and put following configuration.
postrotate
/etc/init.d/rsyslog restart >/dev/null 2>&1 || true


:)