Re: [rsyslog] [EXTERNAL] Re: imfile rsyslog config sporadic since upgrade to ubuntu20

2024-04-22 Thread Ian Diddams via rsyslog
>> Is there any chance that they are getting logged under a different hostname? I've done an extensive search in the rsyslog server this morning, and the answer is sadly no. Confidentiality notice: This email (and any attachment) is intended for the addressee(s) named above. It may contain in

Re: [rsyslog] [EXTERNAL] Re: imfile rsyslog config sporadic since upgrade to ubuntu20

2024-04-22 Thread David Lang via rsyslog
On Mon, 22 Apr 2024, Ian Diddams wrote: Is there any chance that they are getting logged under a different hostname? I've done an extensive search in the rsyslog server this morning, and the answer is sadly no. try logging the local4 facility to a different, fixed file (rather than a dyna

Re: [rsyslog] [EXTERNAL] Re: imfile rsyslog config sporadic since upgrade to ubuntu20

2024-04-22 Thread Ian Diddams via rsyslog
>> specifically look for 127.0.0.1 or localhost see previous message . Nothing. OK, Ive just set this up local4.* /tmp/Tlocal.log I created that log and chmod 777 for it to remove any silly potential issues and restarted rsyslog on the central server No change. Client logs have new entrie

Re: [rsyslog] [EXTERNAL] Re: imfile rsyslog config sporadic since upgrade to ubuntu20

2024-04-22 Thread nope via rsyslog
Having experienced something similar a few years ago (imfile not seeing new messages added to a certain log file), I'll throw this idea: in my case, it was because the statefile associated with this log file got corrupted or something. Granted, I was messing around with the log file that imfile

Re: [rsyslog] [EXTERNAL] Re: imfile rsyslog config sporadic since upgrade to ubuntu20

2024-04-22 Thread David Lang via rsyslog
depending on your distro SELinux or AppArmor may be preventing rsyslog from writing to /tmp, stick it in /var/log to avoid that. can you get a short debug dump during a time that you send such a log? just to be sure, this local4 is not showing up on the client, but is showing up on the central

Re: [rsyslog] [EXTERNAL] Re: imfile rsyslog config sporadic since upgrade to ubuntu20

2024-04-22 Thread Ian Diddams via rsyslog
>Having experienced something similar a few years ago (imfile not seeing new >messages added to a certain log file), I'll throw this idea: in my case, it >was because >the statefile associated with this log file got corrupted or >something. Granted, I was messing around with the log file that im

Re: [rsyslog] [EXTERNAL] Re: imfile rsyslog config sporadic since upgrade to ubuntu20

2024-04-22 Thread John Chivian via rsyslog
If a file is rotated without rsyslog’s knowledge the state file becomes out of date. The state file is just a high-water mark for the file and is not guaranteed to be updated in all cases. State files are created in the statefile.directory and are convieniently named imfile-state* where the re