[rsyslog] imfile state file

[Andreas Piesk]

On 02.11.2011 16:00, Bob Corsaro wrote:
> 
> Yes. I think it could be logrotate causing the issue. Are there any best
> practices to avoid duplicate logs? I open to an alternative option for
> rolling the logs.
> 

have you considered sending the logs after they have been rotated to avoid any duplicates?
you know, something like 'logger -p local0.debug -f <file>', probably in logrotates post-script?

i have test cases even for 5.8.6 where at least some lines are duplicated but it doesn't matter in
my case because i use syslog for monitoring/security only, not for accounting.

regards,
-ap