[rsyslog-notify] Forum Thread: Compressed output files not respecting flushInterval - (Mode 'post')

[noreply at adiscon.com]

User: jodar 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=26539#p26539

Message: 
----------
I am using Oracle Linux 7 (this will be deployed on OL6 and OL7 servers)
with rsyslog 7.4.7.  I also tried to rsyslog 8.1.8, but the results are the
same.  I want to have application logs on the local system duplicated in
compressed form into a shared directory.  However, when using compression
it can take a long time for the file to get flushed.  It appears to wait
for the buffer to be full even though I am specifying the flushInterval
parameter.

My config
[code:2a49f0xw]
module(load="imfile")

input(
    type="imfile"
    tag="processname,logfile.log"
    severity="info"
    facility="local1"
    statefile="processname_logfile_log"
    file="/users/yyz/app/logs/logfile.log"
)

template(name="my_log_fmt" type="list") {
     property(name="msg" droplastlf="on")
     constant(value="\n")
}

# Log location and filename come from the two SYSLOGTAG fields and
hostname.
# Fields are process name and log filename.
template(
     name="Dyn.my_log"
     type="string"
    
string="/shared/logs/%SYSLOGTAG:F,44:1%/%HOSTNAME%/%SYSLOGTAG:F,44:2%-%$NOW%.gz"
)

local1.info action(
    type="omfile"
    template="my_log_fmt"
    dirCreateMode="0700"
    fileCreateMode="0644"
    zipLevel="6"
    dynaFile="Dyn.my_log"
    asyncWriting="on"
    flushInterval="1"
    ioBufferSize="4K"
    flushOnTXEnd="on"
)
[/code:2a49f0xw]


Although most of the log files are written with log4j RollingFileAppender
and are read with the imfile module, there are also logs that come from
stdout and will use logrotate to manage log size and retention.  These pipe
output like this:

app.sh 2>&1 | tee app.out | logger -p local1.info -t "app,app.out,"

I have tried changing various parameters, but the only time flushInterval
appears to be respected is when I set zipLevel="0".  Am I missing some
configuration to make this work how I want?