Hi
I hope I am not missing something obvious here.
I have a template which outputs logs to a gz file. I am using the template for three facilities (local 2, 5 and 6].
When I log a message using one of the facilities, let's say local2, the gz file is created as expected. However, if I use one of the other two facilities (right after i used local2), say local5, it will corrupt the gz file.
This happens if each action is declared on a different line inside config.
However, if I add the actions inside the configuration file on a single line, then it will not corrupt the file
In a nutshell:
The following template will corrupt log.gz file when using local2 AND either of the other two facilities.
$OMFileZipLevel 6
$template HOST_LOGS,"/var/log/%HOSTNAME%.log.gz"
local2.* -?HOST_LOGS
local5.* -?HOST_LOGS
local6.* -?HOST_LOGS
# logger -p local2.info local2
# zcat /var/log/test-srv.example.com.log.gz
2022-05-25T03:28:00.117395-07:00 test-srv.example.com lab: local2
# logger -p local2.info local2-2
# zcat /var/log/test-srv.example.com.log.gz
2022-05-25T03:28:00.117395-07:00 test-srv.example.com lab: local2
2022-05-25T03:29:20.113595-07:00 test-srv.example.com lab: local2-2
# logger -p local5.info local5
# zcat /var/log/test-srv.example.com.log.gz
gzip: test-srv.example.com.log.gz: invalid compressed data--format violated
The following template will NOT corrupt log.gz
$OMFileZipLevel 6
$template HOST_LOGS,"/var/log/%HOSTNAME%.log.gz"
local2.*, local5.*, local6.* -?HOST_LOGS
# logger -p local2.info local2
# zcat /vat/log/test-srv.example.com.log.gz
2022-05-25T03:29:51.937856-07:00 test-srv.example.com lab: local2
# logger -p local5.info local5
# zcat test-srv.example.com.log.gz
2022-05-25T03:29:51.937856-07:00 stest-srv.example.com lab: local2
2022-05-25T03:30:08.403518-07:00 test-srv.example.com lab: local5
# logger -p local6.info local6
# zcat test-srv.example.com.log.gz
2022-05-25T03:29:51.937856-07:00 test-srv.example.com lab: local2
2022-05-25T03:30:08.403518-07:00 test-srv.example.com lab: local5
2022-05-25T03:30:17.589634-07:00 test-srv.example.com lab: local6
# logger -p local2.info local2
# zcat test-srv.example.com.log.gz
2022-05-25T03:29:51.937856-07:00 test-srv.example.com lab: local2
2022-05-25T03:30:08.403518-07:00 test-srv.example.com lab: local5
2022-05-25T03:30:17.589634-07:00 test-srv.example.com lab: local6
2022-05-25T03:30:27.214990-07:00 test-srv.example.com lab: local2
Anyone has faced something similar before?
What could possibly cause this? Some sort of race condition opening the gz file for writing ?
Thanks
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
I hope I am not missing something obvious here.
I have a template which outputs logs to a gz file. I am using the template for three facilities (local 2, 5 and 6].
When I log a message using one of the facilities, let's say local2, the gz file is created as expected. However, if I use one of the other two facilities (right after i used local2), say local5, it will corrupt the gz file.
This happens if each action is declared on a different line inside config.
However, if I add the actions inside the configuration file on a single line, then it will not corrupt the file
In a nutshell:
The following template will corrupt log.gz file when using local2 AND either of the other two facilities.
$OMFileZipLevel 6
$template HOST_LOGS,"/var/log/%HOSTNAME%.log.gz"
local2.* -?HOST_LOGS
local5.* -?HOST_LOGS
local6.* -?HOST_LOGS
# logger -p local2.info local2
# zcat /var/log/test-srv.example.com.log.gz
2022-05-25T03:28:00.117395-07:00 test-srv.example.com lab: local2
# logger -p local2.info local2-2
# zcat /var/log/test-srv.example.com.log.gz
2022-05-25T03:28:00.117395-07:00 test-srv.example.com lab: local2
2022-05-25T03:29:20.113595-07:00 test-srv.example.com lab: local2-2
# logger -p local5.info local5
# zcat /var/log/test-srv.example.com.log.gz
gzip: test-srv.example.com.log.gz: invalid compressed data--format violated
The following template will NOT corrupt log.gz
$OMFileZipLevel 6
$template HOST_LOGS,"/var/log/%HOSTNAME%.log.gz"
local2.*, local5.*, local6.* -?HOST_LOGS
# logger -p local2.info local2
# zcat /vat/log/test-srv.example.com.log.gz
2022-05-25T03:29:51.937856-07:00 test-srv.example.com lab: local2
# logger -p local5.info local5
# zcat test-srv.example.com.log.gz
2022-05-25T03:29:51.937856-07:00 stest-srv.example.com lab: local2
2022-05-25T03:30:08.403518-07:00 test-srv.example.com lab: local5
# logger -p local6.info local6
# zcat test-srv.example.com.log.gz
2022-05-25T03:29:51.937856-07:00 test-srv.example.com lab: local2
2022-05-25T03:30:08.403518-07:00 test-srv.example.com lab: local5
2022-05-25T03:30:17.589634-07:00 test-srv.example.com lab: local6
# logger -p local2.info local2
# zcat test-srv.example.com.log.gz
2022-05-25T03:29:51.937856-07:00 test-srv.example.com lab: local2
2022-05-25T03:30:08.403518-07:00 test-srv.example.com lab: local5
2022-05-25T03:30:17.589634-07:00 test-srv.example.com lab: local6
2022-05-25T03:30:27.214990-07:00 test-srv.example.com lab: local2
Anyone has faced something similar before?
What could possibly cause this? Some sort of race condition opening the gz file for writing ?
Thanks
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.