On Fri, 2013-04-19 at 05:32 +0000, Rainer Gerhards wrote: > On Thu, 2013-04-18 at 18:58 -0700, David Lang wrote: > > On Thu, 18 Apr 2013, stormdancer wrote: > > > > > Hello > > > > > > I used rsyslog-5.8.6 for 1 years, some configure keyword like bellow: > > > > > > # configuration for rsyslog collectors > > > # > > > $template BareMsgFormat,"%msg:2:$:drop-last-lf%\n" > > > $template MhStdLogFile, > > > "/data01/data/apache/%hostname%/%syslogtag:R,ERE,1,BLANK:(.+)/(.+):--end%/%timestamp:1:4:date-rfc3339%_%timestamp:6:7:date-rfc3339%_%timestamp:9:10:date-rfc3339%/%syslogtag:R,ERE,2,BLANK:(.+)/(.+):--end%_%timestamp:1:4:date-rfc3339%_%timestamp:6:7:date-rfc3339%_%timestamp:9:10:date-rfc3339%_%timestamp:12:13:date-rfc3339%.log.gz" > > > $OMFileAsyncWriting on > > > $OMFileIOBufferSize 256k > > > $OMFileFlushOnTXEnd off > > > $OMFileFlushInterval 8 > > > $OMFileZipLevel 6 > > > *.* -?MhStdLogFile;BareMsgFormat > > > > > > When log begin to transfer I can see log file was generate on collector > > > server. File was in gzip format and it's Bytes changes frequently (per 4K > > > or > > > some seconds). Its proved that configuration begin with $OMFile above > > > takes > > > effects. > > > Yesterday, I update rsyslog to rsyslog-7.2.7 and rsyslog-7.3.10, some > > > configuration changed to: > > > > > > # > > > $template BareMsgFormat,"%msg:2:$:drop-last-lf%\n" > > > $template MhStdLogFile, > > > "/data01/data/apache/%hostname%/%syslogtag:R,ERE,1,BLANK:(.+)/(.+):--end%/%timestamp:1:4:date-rfc3339%_%timestamp:6:7:date-rfc3339%_%timestamp:9:10:date-rfc3339%/%syslogtag:R,ERE,2,BLANK:(.+)/(.+):--end%_%timestamp:1:4:date-rfc3339%_%timestamp:6:7:date-rfc3339%_%timestamp:9:10:date-rfc3339%_%timestamp:12:13:date-rfc3339%.log.gz" > > > # $OMFileAsyncWriting on > > > # $OMFileIOBufferSize 256k > > > # $OMFileFlushOnTXEnd off > > > # $OMFileFlushInterval 8 > > > action(type="omfile" ZipLevel="6" CreateDirs="on" DirCreateMode="0755" > > > FileCreateMode="0644" IOBufferSize="256k" ASyncWriting="on" > > > FlushOnTXEnd="off" FlushInterval="8" DynaFile="MhStdLogFile" > > > Template="BareMsgFormat") > > > > > > Now, when log begin to transfer, file also can generate in dest dir on > > > collector server and in gzip format. But this time file changed NOT > > > frequently. It seems that configuration (IOBufferSize="256k" > > > ASyncWriting="on" FlushOnTXEnd="off" FlushInterval="8") did not take > > > effects. Until I shutdown the rsyslog with 'service rsyslog stop|restart' > > > then file-size increased. In my case, file generate per hour, I always > > > find > > > that all the files in recent hours are only 10byte-sized. When I shutdown > > > the server, all file-size will increased an bigger then 10byte. > > > > > > All rsyslog talked above I use the some configure command bellow: > > > # ./configure --prefix=/apps/usr/rsyslog-x.x.xx --enable-impstats > > > # ./configure --prefix=/apps/usr/rsyslog-7.3.10 --enable-impstats > > > > > > I have noticed the description about ASyncWriting FlushOnTXEnd and > > > FlushInterval in help documents, but I am still confused. > > > Waiting for your answer, tks a lot. > > > Sorry for my poor english, hope I can describe the right problem. > > > > There is a high probability that if you start rsyslog in debug mode > > (http://www.rsyslog.com/doc/troubleshoot.html), that the log it outputs > > will > > have some messages that tell us what's going on when it defines the action. > > You > > probably do not need it to process any logs (or if any, very few) as the > > problem is likely to be found at the time the action is defined. > > > > Rainer will probably need to look at this when he gets in the office > > (usually > > about 3-4 hours from now) > > If I understood correctly, the old version was buggy (and, yes, I > remember such a bug). If the buffer is set to 256KiB and async writing > and no commit on TX end, then rsyslog shall only write when the 256KiB > have filled up. Together with ZIP mode, this may mean it needs to have > two to four MiB before doing a write.
Sorry, I overlooked the flush interval ;) Looks like it should write. Unfortunately, I am on the edge of being off to a business trip and have no time left to look into that right now. Please ping me around the 26th, but it may take until May, 2nd before I can have a look. Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
