[rsyslog-notify] Forum Thread: imfile doesn't release deleted files - (Mode 'post')

[noreply at adiscon.com]

User: aturetta 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=25872#p25872

Message: 
----------
I have some servers where I use rsyslog to read Apache Traffic Server
access logs and forward it to a central hub.
ATS has internal log rotation logic. When a log file must be rotated, it
renames the current file by adding a timestamp and the '.old' suffix, and
then reopens the base file.
Additionally, a minimum free disk threshold (In my case 1GB) makes ATS
delete the oldest rotated files until it reaches the minimum free space.
If, after deleting all old log files, the free disk remains under the
threshold, ATS stops logging.

This morning I stopped receiving logs from the proxies. The server reported
less than 1GB free on the log volume, while the space used by the existing
files should have left at least 14GB free.
I restarted rsyslogd, and immediately the free disk jumped to 14GB, and ATS
resumed logging.
This is my input action:
[code:wixohdbp]input(type="imfile"
File="/var/log/trafficserver/access.log" Tag="proxy"
ruleset="trafficserverToHub")[/code:wixohdbp]
My suspect is that imfile keeps input inodes open and ignores unlink
events....
Do you have any hints on how to work-around this behavior?