[rsyslog-notify] Forum Thread: Re: imfile will skip last lines in rotated file - (Mode 'reply')

[noreply at adiscon.com]

User: erikseres 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=25917#p25917

Message: 
----------
The file is created and written by our custom application. When logrotate
rotates the file, the application is notified by logrotate as a post-rotate
action. In response to that notification, the application closes the file
and reopens it. That is, it is possible that the application will continue
to write to the rotated file until it receives the notification and reopens
the file.

Logrotate is set up to not create a new file after rotation, it is the
application that will create the file after rotation.

I looked at imfile.c and see that it registers for the IN_CREATE, IN_DELETE
and IN_MOVED_FROM events. With debug messages enabled and our custom app
shut down, I see that the IN_CREATE event and its handling will not happen
upon rotation - which is expected as the application is not running. With
the application running, I do see that imfile does receive the IN_CREATE
event and handles it.

What leaves me puzzled is that I know that our application won't write to
the rotated file after it has closed and created a new one. From
interpreting rsyslog debug output, I also understand that imfile will
continue to monitor the rotated file until the IN_CREATE event has been
received - at which point there should be no further lines written into the
old files. I don't see the potential for a race condition here.

One other piece of information is that this will only happen if the message
rate is at least a few per second. It has not happened so far at lower
rates.

We have six servers running the same application but three of them are
running rsyslog 8.11 and three running 8.12. The error is happening only on
those running rsyslog-relp 8.12.