[rsyslog] Disappearing buffered remote logs on reboot/boot

Bgs bgs at bgs.hu
Thu Dec 2 18:22:24 CET 2010


  Hi all,

I ran into a strange problem. My setup:

Ubuntu, rsyslog with remote tcp logging to central syslog server. 
Connection is periodic, so I need the buffer to file ability of rsyslog.
Ubuntu 10.04LTS, rsyslog 4.2.0-2ubuntu8, using imuxsock module for 
remote logging.
Config:
  queue type = linkedlist
  workdirectory/filename/maxdiskpace set
  saveonshutdown on
  retrycount -1

What I would expect when there is no connection at reboot is: save in 
memory buffer to file (create if there was nothing there yet), at boot 
open it and send it in at the first opportunity.

What actually happens: A portion of the buffer is saved to file (checked 
by booting from outside and looking at the rsyslog spool) and when the 
system boots up, the file disappears without any content showing up on 
the remote side. After the last message before connection break, the 
next one that gets through are the boot logs.

During normal operation, connection breaks are handled without any problem.

What might the problem be? Configuration problem? Ubuntu upstart 
related? rsyslog bug?

Regards
Bgs



More information about the rsyslog mailing list