[rsyslog] imfile state file
a.piesk at gmx.net
Wed Nov 2 20:15:40 CET 2011
On 02.11.2011 16:00, Bob Corsaro wrote:
> Yes. I think it could be logrotate causing the issue. Are there any best
> practices to avoid duplicate logs? I open to an alternative option for
> rolling the logs.
have you considered sending the logs after they have been rotated to avoid any duplicates?
you know, something like 'logger -p local0.debug -f <file>', probably in logrotates post-script?
i have test cases even for 5.8.6 where at least some lines are duplicated but it doesn't matter in
my case because i use syslog for monitoring/security only, not for accounting.
More information about the rsyslog