[rsyslog-notify] Forum Thread: Re: imfile seems to just stop reading files - (Mode 'reply')

[noreply at adiscon.com]

User: vizette 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=26832#p26832

Message: 
----------
A little more on this - confirmed that logs rotated by logrotate appear to
not be read by rsyslog after rotation, yet files rotated by the app do
continue to be sent.  The odd thing is that I cannot force the issue to
happen by manually running logrotate.  I'll see if I can capture anything
odd during a rotation with strace tonight...

I suppose there could be something else happening at the same time via
cron.daily but I'm not sure what else would interfere.  I'd be more
inclined to think it was an environment issue with cron, but that should
affect all logs, not just the ones being written to by rsyslog.

I'm also still assuming this is an rsyslog issue reading the log and not an
omkafka isssue, as I still see traffic between the host and the kafka
cluster, but it's just sending blank data.  Once I restart rsyslog I see
the same traffic but there is log data in it (viewed via tcpdump).

Any other suggestions on settings to try?

-Rich