[rsyslog] imfile state file

[david at lang.hm]

On Wed, 2 Nov 2011, Michael Biebl wrote:

> 2011/11/1 Bob Corsaro <rcorsaro at gmail.com>:
>> If there is a better way to do what I'm doing, I'm all ears. I just
>> basically need to send varnish logs to a syslog daemon on a remote server.
>>
>> I'm using rsyslog 4.2.0 packaged with Ubuntu lucid to ship varnish logs to
>> a remote server.  The related part of my config looks like this:
>
> [..]
>
>> Anyway, I tried upgrading to 4.8.0, which does leave a state file in
>> $WorkDirectory right away, instead of waiting for rsyslog to exit, but it
>> doesn't seem to respect the $InputFilePersistStateInterval .  I've received
>> well over 20k logs since starting it, but the state file remains unchanged.
>
> I've been working on a scenario similar to yours. Several Ubuntu Lucid
> servers with 4.2 which read from a custom log file and forward that to
> a central rsyslog server collecting the logs.
> I also noticed, that 4.2 does not create the state file and iirc I've
> also seen the resend-logs-on-restart issue, you mentioned, but I
> haven't investigated that further.
>
> Rainer generally recommends to *not* use 4.2.
> I'm suprised though, as you mentioned that 4.8 is showing the same
> behaviour, unless I misunderstood you.

I think it was version 5 that changed the behavior of HUP so that it 
didn't do a full shutdown/restart but instead just closed and reopened 
files (which is what's needed for log rotation)

I would strongly recommend moving to version 5.

David Lang