Mailing List Archive: rsyslog imfile missing logs messages

Hi All,
we tried to configure a rsyslog instance to keep all messages present into
a file rotated by an application when the size is 100 MB via imfile module.
We didn't notice issues with a slow number of message, but if we increased
the number of messages per minutes (400 MB/minute average), the rsyslog
instance didn't forward 2 minutes of logs every 5 minutes.

We tried to configure a queue but the problem persisted. We also tried to
not forwarding the logs via omfwd but via omfile locally on the same server
and the behavior is the same.

Could you help us to understand if the problem was related to logrotate
action or if there were some limitations/thresholds on imfile?

Thanks,
Marcello
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

what is your rsyslog config, and how is the file being rotated (is it being
truncted and filled again, or deleted and a new file created)

do you have a cron job restarting rsyslog every 5 min or anything else like
that?

David Lang

On Thu, 29 Jul 2021, Marcello Lorenzi via rsyslog wrote:

> Date: Thu, 29 Jul 2021 18:17:21 +0200
> From: Marcello Lorenzi via rsyslog <rsyslog@lists.adiscon.com>
> To: rsyslog@lists.adiscon.com
> Cc: Marcello Lorenzi <cello86@gmail.com>
> Subject: [rsyslog] rsyslog imfile missing logs messages
>
> Hi All,
> we tried to configure a rsyslog instance to keep all messages present into
> a file rotated by an application when the size is 100 MB via imfile module.
> We didn't notice issues with a slow number of message, but if we increased
> the number of messages per minutes (400 MB/minute average), the rsyslog
> instance didn't forward 2 minutes of logs every 5 minutes.
>
> We tried to configure a queue but the problem persisted. We also tried to
> not forwarding the logs via omfwd but via omfile locally on the same server
> and the behavior is the same.
>
> Could you help us to understand if the problem was related to logrotate
> action or if there were some limitations/thresholds on imfile?
>
> Thanks,
> Marcello
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
>
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.