[rsyslog] Feature suggestion: Query rsyslog daemon for a list of currently-open log files.

[david at lang.hm]

On Tue, 8 Dec 2009, Ryan Lynch wrote:

> Obviously this isn't a low priority suggestion, but I think it could
> be a pretty useful in managing large/complex Rsyslog configurations.
>
> On some of my Linux hosts, I have Rsyslog configured such that it can
> easily hold 20-30 open files at any given time. (I'm using the utility
> 'lsof', BTW, to list open files, like so: `lsof | gawk '$1 ~
> "^rsyslogd$" && $9 ~ "^/var/log/"'`) Since I'm using dynamic templates
> with date/time elements, the exact list of currently-open files
> changes from minute to minute.
>
> It would be helpful for the Rsyslog daemon to periodically output a
> list of all the log files (by full path) that it currently holds open.
> Primarily, I'd use this for log file rotation and similar maintenance
> tasks, but I could imagine others would find other uses, especially if
> the output mechanism were generic enough to dump other runtime
> statistics, too. If Rsyslog kept a count of the number of bytes
> written to each open file, and included those per-byte counts in the
> output, another program could monitor log-output rates, to watch out
> for dangerously high disk I/O loads.
>
> I don't really have a fixed idea for the communication mechanism. It
> could be as simple as having Rsyslog dump the stats to a text file,
> and add a configuration knob to tell it how many seconds to wait
> between dumps. The output format wouldn't need to be simple, maybe
> just a newline-delimited list of file names/stats.
>
> If I get some free time, and nobody objects, I may try to implement
> this. But I'm pretty rusty with C, so I figured I should ask whether
> the idea floats, first.

you can find this information via lsof (or via /proc)

this doesn't mean that querying rsyslog isn't better in the long run, just 
ways to deal with the problem in the mantime.

David Lang