[rsyslog] how to best rotate files

[Rainer Gerhards]

On Mon, 2008-09-15 at 00:17 -0700, david at lang.hm wrote:
> On Mon, 15 Sep 2008, Rainer Gerhards wrote:
> 
> >> I get a couple of rotations sucessfully (with ~22,000 logs/sec in the
> >> files), but then rsyslog seems to hang.
> >> lsof show it with the file open that was moved (and later deleted by
> >> gzip).
> >> I need to do a kill -9 of rsyslogd to get it to recover.
> >
> > Definitely a bug... I now "just" need to find out where. I guess there
> > is some mutex issue in the queue engine during shutdown. Don't expect a
> > fix too soon, but I'll do my best. I hope I can find a simpler error
> > condition (if my conclusion on the problem source is right...)
> 
> let me know if you need me to try anything. given the volume of logs I 
> don't know if it would be worth trying to do a strace.

I agree, it doesn't make any sense. It may be worth trying to run
rsyslog with runtime instrumentation turned on in debug mode. That will
generate tons of debug output and it will make things awfully slow, but
at least we may be able to get some information out of it.

... well... one thing: could you run an unmodified version of WinSyslog
under valgrind and let me know if there are any valgrind exceptions
before it hangs? This, too, will make it very slow, but I guess/hope
that doesn't affect the outcome.

Rainer