Hi I am having big problems setting up our logserver to run correctly, collecting logs from 15 other servers.
If I set it up the normal way, ie. sending a "kill -HUP" to rsyslog after logrotate has run, som logs are not sent to the logserver, and after some days it is clear that rsyslog does not correctly keep track of how long it has come in the different log files, I can see that by the number of files in /var/lib/rsyslog becoming bigger and bigger. This morning I did a grep for messages in the files, and got 3 results, so there must be a problem there. Then I found a post on google, where someone did a "stop rsyslog; delete all files in /var/lib/rsyslog; start rsyslog" to get over this problem, and then logging work perfectly, but then some very old log entries are inserted into the log files, what I see is that there are 1-3 lines from the correct time, and then a few thousand lines from 2 months ago, and then the correct log entries come again, this happens every day, and the old log entries are the same day after day. The servers are set up to use relp to lose as few logs as possible, and make a cache file if the receiving server is offline for some reason. Best regards Allan Jacobsen _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
