Mailing List Archive

rsyslog: some logs stop collected
For unknown reason some logs stop collecting several days ago on 2 of my
centos7 opevz7 vds.

cron, nginx, postfix.
some other services (dovecot, yum) logs collected w/o problems.

HDD space/inodes is OK.
I tried to resetup rsyslogd, cron - not helped.
I enable DebugLevel2 but logfile deos not grow (it is grow on other
servers where no problem with logging).


Do not understand, what can be wrong?


*****************************************************
# ls -lt /var/log
total 54600
-rw------- 1 root root 51681 Aug 17 13:02 rsyslog.debug
drwxr-xr-x 8 root root 4096 Aug 17 13:02 .
-rw------- 1 root root 328197 Aug 17 13:00 lfd.log
-rw------- 1 vmail mail 15777 Aug 17 12:50 dovecot.log
-rw------- 1 vmail mail 71917 Aug 17 12:38 dovecot-info.log
-rw-rw-r-- 1 root utmp 472704 Aug 17 12:21 wtmp
-rw------- 1 root root 25441 Aug 17 00:19 yum.log
drwxr-xr-x 2 root root 4096 Aug 17 00:00 sa
-rw-r--r-- 1 root root 8104 Aug 16 23:17
cwp_client_login.log
drwxr-xr-x 2 root root 4096 Aug 16 03:28 nginx
-rw-r--r-- 1 root root 298716 Aug 16 01:24 lastlog
-rw------- 1 root root 2069997 Aug 12 23:40 messages
-rw------- 1 root root 1050832 Aug 12 23:40 cron
-rw------- 1 root root 4218951 Aug 12 23:40 maillog
-rw------- 1 root root 2357 Aug 12 23:40 secure

**************
# df -H
Filesystem Size Used Avail Use% Mounted on
/dev/ploop41851p1 2.2T 6.9G 2.1T 1% /

# df -i
Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/ploop41851p1 134217728 130569 134087159 1% /

**************

# tail -f /var/log/rsyslog.debug -n20
6144.046925524:main thread : main Q: params: type 0, enq-only 0, disk
assisted 0, spoolDir '/var/lib/rsyslog', maxFileSz 1048576, maxQSize
100000, lqsize 0, pqsize 0, child 0, full delay 97000, light delay
70000, deq batch size 256, high wtrmrk 80000, low wtrmrk 20000,
discardmrk 98000, max wrkr 2, min msgs f. wrkr 40000
6144.046932856:main thread : main Q:Reg: finalizing construction of
worker thread pool (numworkerThreads 2)
6144.046936396:main thread : main Q:Reg/w0: finalizing construction
of worker instance data (for 7 actions)
6144.046941143:main thread : main Q:Reg/w1: finalizing construction
of worker instance data (for 7 actions)
6144.046945039:main thread : main Q: queue finished initialization
6144.046950299:main thread : Main processing queue is initialized and
running
6144.046953612:main thread : running module imuxsock with config
0x55a8e2ab97a0, term mode: cooperative/SIGTTIN
6144.046992581:main thread : running module imjournal with config
0x55a8e2ac06e0, term mode: cooperative/SIGTTIN
6144.047005869:7f7866abb700: thread created, tid 14614, name 'in:imuxsock'
6144.047014023:main thread : configuration 0x55a8e2aa7850 activated
6144.047039376:7f7866abb700: set thread name to 'in:imuxsock'
6144.047061121:7f78666ba700: thread created, tid 14615, name 'in:imjournal'
6144.047069788:7f78666ba700: set thread name to 'in:imjournal'
6144.047180420:imuxsock.c : thrdStarter: usrThrdMain imuxsock -
0x7f7866abb700 returned with iRet 0, exiting now.
6144.047185737:imjournal.c : ratelimit:imjournal:new
ratelimiter:bReduceRepeatMsgs 0
6144.047197373:imjournal.c : imjournal: ratelimiting burst 20000,
interval 600
6144.047203919:main thread : rsyslogd: writing pidfile
'/var/run/syslogd.pid.tmp'.
6144.047242054:main thread : rsyslogd: initialization completed,
transitioning to regular run mode
6144.047248416:imuxsock.c : destructor for debug call stack
0x7f7860000950 called
6744.113795334:main thread : janitorRun() called

*****************************************************
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: rsyslog: some logs stop collected [ In reply to ]
rsyslog version?

El sáb., 17 ago. 2019 a las 12:19, UNLIM.SRV via rsyslog
(<rsyslog@lists.adiscon.com>) escribió:
>
> For unknown reason some logs stop collecting several days ago on 2 of my
> centos7 opevz7 vds.
>
> cron, nginx, postfix.
> some other services (dovecot, yum) logs collected w/o problems.
>
> HDD space/inodes is OK.
> I tried to resetup rsyslogd, cron - not helped.
> I enable DebugLevel2 but logfile deos not grow (it is grow on other
> servers where no problem with logging).
>
>
> Do not understand, what can be wrong?
>
>
> *****************************************************
> # ls -lt /var/log
> total 54600
> -rw------- 1 root root 51681 Aug 17 13:02 rsyslog.debug
> drwxr-xr-x 8 root root 4096 Aug 17 13:02 .
> -rw------- 1 root root 328197 Aug 17 13:00 lfd.log
> -rw------- 1 vmail mail 15777 Aug 17 12:50 dovecot.log
> -rw------- 1 vmail mail 71917 Aug 17 12:38 dovecot-info.log
> -rw-rw-r-- 1 root utmp 472704 Aug 17 12:21 wtmp
> -rw------- 1 root root 25441 Aug 17 00:19 yum.log
> drwxr-xr-x 2 root root 4096 Aug 17 00:00 sa
> -rw-r--r-- 1 root root 8104 Aug 16 23:17
> cwp_client_login.log
> drwxr-xr-x 2 root root 4096 Aug 16 03:28 nginx
> -rw-r--r-- 1 root root 298716 Aug 16 01:24 lastlog
> -rw------- 1 root root 2069997 Aug 12 23:40 messages
> -rw------- 1 root root 1050832 Aug 12 23:40 cron
> -rw------- 1 root root 4218951 Aug 12 23:40 maillog
> -rw------- 1 root root 2357 Aug 12 23:40 secure
>
> **************
> # df -H
> Filesystem Size Used Avail Use% Mounted on
> /dev/ploop41851p1 2.2T 6.9G 2.1T 1% /
>
> # df -i
> Filesystem Inodes IUsed IFree IUse% Mounted on
> /dev/ploop41851p1 134217728 130569 134087159 1% /
>
> **************
>
> # tail -f /var/log/rsyslog.debug -n20
> 6144.046925524:main thread : main Q: params: type 0, enq-only 0, disk
> assisted 0, spoolDir '/var/lib/rsyslog', maxFileSz 1048576, maxQSize
> 100000, lqsize 0, pqsize 0, child 0, full delay 97000, light delay
> 70000, deq batch size 256, high wtrmrk 80000, low wtrmrk 20000,
> discardmrk 98000, max wrkr 2, min msgs f. wrkr 40000
> 6144.046932856:main thread : main Q:Reg: finalizing construction of
> worker thread pool (numworkerThreads 2)
> 6144.046936396:main thread : main Q:Reg/w0: finalizing construction
> of worker instance data (for 7 actions)
> 6144.046941143:main thread : main Q:Reg/w1: finalizing construction
> of worker instance data (for 7 actions)
> 6144.046945039:main thread : main Q: queue finished initialization
> 6144.046950299:main thread : Main processing queue is initialized and
> running
> 6144.046953612:main thread : running module imuxsock with config
> 0x55a8e2ab97a0, term mode: cooperative/SIGTTIN
> 6144.046992581:main thread : running module imjournal with config
> 0x55a8e2ac06e0, term mode: cooperative/SIGTTIN
> 6144.047005869:7f7866abb700: thread created, tid 14614, name 'in:imuxsock'
> 6144.047014023:main thread : configuration 0x55a8e2aa7850 activated
> 6144.047039376:7f7866abb700: set thread name to 'in:imuxsock'
> 6144.047061121:7f78666ba700: thread created, tid 14615, name 'in:imjournal'
> 6144.047069788:7f78666ba700: set thread name to 'in:imjournal'
> 6144.047180420:imuxsock.c : thrdStarter: usrThrdMain imuxsock -
> 0x7f7866abb700 returned with iRet 0, exiting now.
> 6144.047185737:imjournal.c : ratelimit:imjournal:new
> ratelimiter:bReduceRepeatMsgs 0
> 6144.047197373:imjournal.c : imjournal: ratelimiting burst 20000,
> interval 600
> 6144.047203919:main thread : rsyslogd: writing pidfile
> '/var/run/syslogd.pid.tmp'.
> 6144.047242054:main thread : rsyslogd: initialization completed,
> transitioning to regular run mode
> 6144.047248416:imuxsock.c : destructor for debug call stack
> 0x7f7860000950 called
> 6744.113795334:main thread : janitorRun() called
>
> *****************************************************
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.