Hello, On Mon, Mar 8, 2021 at 12:58 PM John Chivian <jchiv...@chivian.com> wrote:
> It might depend on which input mode is being used, inotify (the default > for the new method of loading the module) or polling (the default for old > method of loading the module). I would think either would work after the > scenario described is repaired, but the experts will know for sure. > > I'm using inotify, and haven't seen it recover after a few minutes. A quick inspection of the code didn't show me a retry mechanism for that either. Polling I suspect would eventually work again. Inotify throws this error (sorry, should have shown this before): Mar 8 13:57:28 b1 rsyslogd: [origin software="rsyslogd" swVersion="8.32.0" x-pid="1606" x-info="http://www.rsyslog.com";] start Mar 8 13:57:28 b1 rsyslogd: imfile: error with inotify API, ignoring file '/var/log/audit/audit.log': Permission denied [v8.32.0] I'm wondering if that "ignoring" is permanent, it looks like it is. _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
