[rsyslog] imfile state file

[david at lang.hm]

On Thu, 3 Nov 2011, Bob Corsaro wrote:

> On Wed, Nov 2, 2011 at 3:15 PM, Andreas Piesk <a.piesk at gmx.net> wrote:
>>
>> On 02.11.2011 16:00, Bob Corsaro wrote:
>>>
>>> Yes. I think it could be logrotate causing the issue. Are there any best
>>> practices to avoid duplicate logs? I open to an alternative option for
>>> rolling the logs.
>>>
>>
>> have you considered sending the logs after they have been rotated to avoid any duplicates?
>> you know, something like 'logger -p local0.debug -f <file>', probably in logrotates post-script?
>
> I could but then I don't get realtime reporting, which is super cool.
>
>> i have test cases even for 5.8.6 where at least some lines are duplicated but it doesn't matter in
>> my case because i use syslog for monitoring/security only, not for accounting.
>
> :( The disadvantage of going directly from varnish to the remote
> syslog server is that I lose the ability to store logs if the remote
> syslog daemon is unavailable. Why do you think you get duplicates?

Two options there.

1. go to a local syslog daemon and let it forward

2. make your remote syslog daemon highly available.

writing to a file and then picking it up later is one of the most 
complicated approaches that you can take to move logs.

David Lang