[rsyslog] how to best rotate files

[david at lang.hm]

On Mon, 15 Sep 2008, Rainer Gerhards wrote:

> On Mon, 2008-09-15 at 00:17 -0700, david at lang.hm wrote:
>> On Mon, 15 Sep 2008, Rainer Gerhards wrote:
>>
>>>> I get a couple of rotations sucessfully (with ~22,000 logs/sec in the
>>>> files), but then rsyslog seems to hang.
>>>> lsof show it with the file open that was moved (and later deleted by
>>>> gzip).
>>>> I need to do a kill -9 of rsyslogd to get it to recover.
>>>
>>> Definitely a bug... I now "just" need to find out where. I guess there
>>> is some mutex issue in the queue engine during shutdown. Don't expect a
>>> fix too soon, but I'll do my best. I hope I can find a simpler error
>>> condition (if my conclusion on the problem source is right...)
>>
>> let me know if you need me to try anything. given the volume of logs I
>> don't know if it would be worth trying to do a strace.
>
> I agree, it doesn't make any sense. It may be worth trying to run
> rsyslog with runtime instrumentation turned on in debug mode. That will
> generate tons of debug output and it will make things awfully slow, but
> at least we may be able to get some information out of it.

do I need to recompile it, or is it a config/command line option?

> ... well... one thing: could you run an unmodified version of WinSyslog
> under valgrind and let me know if there are any valgrind exceptions
> before it hangs? This, too, will make it very slow, but I guess/hope
> that doesn't affect the outcome.

I'm running on linux machines, so I don't know if WinSyslog can be made to 
work. I would need to be pointed at the source.

David Lang