Mailing List Archive

It might depend on which input mode is being used, inotify (the default for the new method of loading the module) or polling (the default for old method of loading the module). I would think either would work after the scenario described is repaired, but the experts will know for sure.

Regards,

> On Mar 8, 2021, at 07:31, Andreas Hasenack via rsyslog <rsyslog@lists.adiscon.com> wrote:
>
> Hi,
>
> I have a config statement using imfile to read a log file produced by a
> daemon. When rsyslog starts up, all is fine.
>
> But there was a bad cronjob that would break the permissions of several
> files, including this one rsyslog is reading. It's still fine if that
> happens after rsyslog started, but eventually that log will be rotated and
> then rsyslog can't read the new file due to the permission problem.
>
> Question is, if the permissions are fixed after rsyslog encountered that
> error, will rsyslog eventually retry reading the file? Or does it need to
> be restarted?
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Hello,

On Mon, Mar 8, 2021 at 12:58 PM John Chivian <jchivian@chivian.com> wrote:

> It might depend on which input mode is being used, inotify (the default
> for the new method of loading the module) or polling (the default for old
> method of loading the module). I would think either would work after the
> scenario described is repaired, but the experts will know for sure.
>
>
I'm using inotify, and haven't seen it recover after a few minutes. A quick
inspection of the code didn't show me a retry mechanism for that either.
Polling I suspect would eventually work again.

Inotify throws this error (sorry, should have shown this before):
Mar 8 13:57:28 b1 rsyslogd: [origin software="rsyslogd"
swVersion="8.32.0" x-pid="1606" x-info="http://www.rsyslog.com"] start
Mar 8 13:57:28 b1 rsyslogd: imfile: error with inotify API, ignoring file
'/var/log/audit/audit.log': Permission denied [v8.32.0]
I'm wondering if that "ignoring" is permanent, it looks like it is.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Yes, the ignore is kind of permanent. However, even in inotify mode
relatively recent (since 2 yrs ago?) versions of rsyslog also do some
polling-like behaviour, so it should recover eventually. But this
depends on activity of other monitored files. So if the file with
wrong permissions is the only one, it will not recover. It probably is
an idea to add a periodically forced poll run.

Rainer

El lun, 8 mar 2021 a las 18:28, Andreas Hasenack via rsyslog
(<rsyslog@lists.adiscon.com>) escribió:
>
> Hello,
>
> On Mon, Mar 8, 2021 at 12:58 PM John Chivian <jchivian@chivian.com> wrote:
>
> > It might depend on which input mode is being used, inotify (the default
> > for the new method of loading the module) or polling (the default for old
> > method of loading the module). I would think either would work after the
> > scenario described is repaired, but the experts will know for sure.
> >
> >
> I'm using inotify, and haven't seen it recover after a few minutes. A quick
> inspection of the code didn't show me a retry mechanism for that either.
> Polling I suspect would eventually work again.
>
> Inotify throws this error (sorry, should have shown this before):
> Mar 8 13:57:28 b1 rsyslogd: [origin software="rsyslogd"
> swVersion="8.32.0" x-pid="1606" x-info="http://www.rsyslog.com"] start
> Mar 8 13:57:28 b1 rsyslogd: imfile: error with inotify API, ignoring file
> '/var/log/audit/audit.log': Permission denied [v8.32.0]
> I'm wondering if that "ignoring" is permanent, it looks like it is.
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

a HUP won't cause it to retry?

David Lang

On Tue, 9 Mar 2021, Rainer Gerhards via rsyslog wrote:

> Yes, the ignore is kind of permanent. However, even in inotify mode
> relatively recent (since 2 yrs ago?) versions of rsyslog also do some
> polling-like behaviour, so it should recover eventually. But this
> depends on activity of other monitored files. So if the file with
> wrong permissions is the only one, it will not recover. It probably is
> an idea to add a periodically forced poll run.
>
> Rainer
>
> El lun, 8 mar 2021 a las 18:28, Andreas Hasenack via rsyslog
> (<rsyslog@lists.adiscon.com>) escribió:
>>
>> Hello,
>>
>> On Mon, Mar 8, 2021 at 12:58 PM John Chivian <jchivian@chivian.com> wrote:
>>
>> > It might depend on which input mode is being used, inotify (the default
>> > for the new method of loading the module) or polling (the default for old
>> > method of loading the module). I would think either would work after the
>> > scenario described is repaired, but the experts will know for sure.
>> >
>> >
>> I'm using inotify, and haven't seen it recover after a few minutes. A quick
>> inspection of the code didn't show me a retry mechanism for that either.
>> Polling I suspect would eventually work again.
>>
>> Inotify throws this error (sorry, should have shown this before):
>> Mar 8 13:57:28 b1 rsyslogd: [origin software="rsyslogd"
>> swVersion="8.32.0" x-pid="1606" x-info="http://www.rsyslog.com"] start
>> Mar 8 13:57:28 b1 rsyslogd: imfile: error with inotify API, ignoring file
>> '/var/log/audit/audit.log': Permission denied [v8.32.0]
>> I'm wondering if that "ignoring" is permanent, it looks like it is.
>> _______________________________________________
>> rsyslog mailing list
>> https://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

actually not, but that would also be an obvious option.

Rainer

El mar, 9 mar 2021 a las 8:44, David Lang (<david@lang.hm>) escribió:
>
> a HUP won't cause it to retry?
>
> David Lang
>
> On Tue, 9 Mar 2021, Rainer Gerhards via rsyslog wrote:
>
> > Yes, the ignore is kind of permanent. However, even in inotify mode
> > relatively recent (since 2 yrs ago?) versions of rsyslog also do some
> > polling-like behaviour, so it should recover eventually. But this
> > depends on activity of other monitored files. So if the file with
> > wrong permissions is the only one, it will not recover. It probably is
> > an idea to add a periodically forced poll run.
> >
> > Rainer
> >
> > El lun, 8 mar 2021 a las 18:28, Andreas Hasenack via rsyslog
> > (<rsyslog@lists.adiscon.com>) escribió:
> >>
> >> Hello,
> >>
> >> On Mon, Mar 8, 2021 at 12:58 PM John Chivian <jchivian@chivian.com> wrote:
> >>
> >> > It might depend on which input mode is being used, inotify (the default
> >> > for the new method of loading the module) or polling (the default for old
> >> > method of loading the module). I would think either would work after the
> >> > scenario described is repaired, but the experts will know for sure.
> >> >
> >> >
> >> I'm using inotify, and haven't seen it recover after a few minutes. A quick
> >> inspection of the code didn't show me a retry mechanism for that either.
> >> Polling I suspect would eventually work again.
> >>
> >> Inotify throws this error (sorry, should have shown this before):
> >> Mar 8 13:57:28 b1 rsyslogd: [origin software="rsyslogd"
> >> swVersion="8.32.0" x-pid="1606" x-info="http://www.rsyslog.com"] start
> >> Mar 8 13:57:28 b1 rsyslogd: imfile: error with inotify API, ignoring file
> >> '/var/log/audit/audit.log': Permission denied [v8.32.0]
> >> I'm wondering if that "ignoring" is permanent, it looks like it is.
> >> _______________________________________________
> >> rsyslog mailing list
> >> https://lists.adiscon.net/mailman/listinfo/rsyslog
> >> http://www.rsyslog.com/professional-services/
> >> What's up with rsyslog? Follow https://twitter.com/rgerhards
> >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> > _______________________________________________
> > rsyslog mailing list
> > https://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.