Hi, I have noticed that rsyslog is continuing to write to old inodes after executing the action in my outchannel. It also writes to the new file, and eventually I end up with the following in lsof:
rsyslogd 3181 syslog 18w REG 8,16 971174829 11698187 /mnt/log/all rsyslogd 3181 syslog 16w REG 8,16 1074997249 11698190 /mnt/log/all (deleted) Here is my rsyslog config: $Template Normed, "%timereported:::date-rfc3339% %fromhost-ip% %syslogfacility-text%.%syslogpriority-text% %syslogtag% %structured-data% %hostname%%msg:::sp-if-no-1st-sp %%msg%\n" $OutChannel all,/mnt/log/all,1073741824,/usr/local/bin/logrotate /mnt/log/all ## Receive messages over relp :inputname, isequal, "imrelp" $all;Normed & @@localhost:9994;Normed & ~ $ModLoad imrelp $InputRELPServerRun 9996 # Syslog over TCP listeners $ModLoad imtcp ## Listen on 9998 for messages. $RuleSet imtcp :inputname, isequal, "imtcp" $all;Normed & @@localhost:9994;Normed & ~ $InputTCPServerBindRuleset imtcp $InputTCPMaxSessions 2000 $InputTCPServerRun 9998 ## Listen on 9999 for messages. $RuleSet imtcp :inputname, isequal, "imtcp" $all;Normed & @@localhost:9994;Normed & ~ $InputTCPServerBindRuleset imtcp $InputTCPMaxSessions 2000 $InputTCPServerRun 9999 Here is the logrotate script: #!/bin/bash log="$1" keep="3" /usr/bin/savelog -lpnc "$keep" -m 444 "$log" _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/
