what is your rsyslog config, and how is the file being rotated (is it being
truncted and filled again, or deleted and a new file created)
do you have a cron job restarting rsyslog every 5 min or anything else like
that?
David Lang
On Thu, 29 Jul 2021, Marcello Lorenzi via rsyslog wrote:
Date: Thu, 29 Jul 2021 18:17:21 +0200
From: Marcello Lorenzi via rsyslog <[email protected]>
To: [email protected]
Cc: Marcello Lorenzi <[email protected]>
Subject: [rsyslog] rsyslog imfile missing logs messages
Hi All,
we tried to configure a rsyslog instance to keep all messages present into
a file rotated by an application when the size is 100 MB via imfile module.
We didn't notice issues with a slow number of message, but if we increased
the number of messages per minutes (400 MB/minute average), the rsyslog
instance didn't forward 2 minutes of logs every 5 minutes.
We tried to configure a queue but the problem persisted. We also tried to
not forwarding the logs via omfwd but via omfile locally on the same server
and the behavior is the same.
Could you help us to understand if the problem was related to logrotate
action or if there were some limitations/thresholds on imfile?
Thanks,
Marcello
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
