Not currently, no. There is an open request to read a file, then close
and delete. It was entered for the case of log files that are moved
into a watched directory and never grow.
Regards,
On 5/23/20 11:39 AM, Anthony Benitez Borges via rsyslog wrote:
I have a program that generates a lot of individual log files and I am
using rsyslog to process these into a single log file which I then monitor
with a third-party application. I have gone through the manual regarding
the imfile module and understand how I can configure it to use the inotify
API or set it to polling mode. I currently have imfile to use inotify, but
because (to my understanding) this continuously monitors files, the more
files are generated, the more file watches are produced which then at some
point hit the limit listed under /proc/sys/fs/inotify/max_user_watches.
I know I could increase this limit, I know I could have cron jobs
continuously remove these generated log files on short intervals (less than
a week), but what I'm wondering is, *is there a way in the rsyslog
configuration to read a file once, generate a state file, and never look at
it again?*
Thanks,
ABB
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
