On Fri, 30 Nov 2012, Keller, Eric wrote:
Hi everybody,
I did seek for an answer on your mailing list archive, but did not get a
concrete answer concerning the problem I am witnessing with rsyslog and power
failure.
Here are more info:
rsyslog version: 5.8.5
it happens sporadically that our syslog log file does contain only few system
logs like kernel logs but not any of our logs!
We isolated the problem down and could only reproduce the problem by producing
a hard shutdown (hitting the power button)
rsyslog buffers logs in memory, and it does not force a fsync after every log
message is written. As a result, when you do a hard shutdown logs will be lost.
There are parameters to tweak this, but it has a very significant effect on the
rate that rsyslog can process log messages (in the most paranoid mode where zero
log messages would be lost, you can drop from ~400K logs/sec down to ~50
logs/sec if you don't have a high-end disk setup)
When starting up, we noticed that the rsyslogd is running despite no lock was
created in the /tmp/.rsyslog-lock
Another consequence is that our /home/roche/share/log/syslog does not log any
of our project traces.
this sounds like there is something else that's starting rsyslog, other than the
scripts you are showing below.
David Lang
Killing rsyslogd and starting it again will start to log our project entries
into the syslog!
Does someone out there encountered the same problems? Do someone have an idea
why this happens?
Does someone sees a misconfiguration ? Or should I start the rsyslogd in
another way?
here are the configuration files: note: there are no additional configuration
files in the /home/roche/etc/rsyslog.d/
------------------------------------
rsyslog.conf-----------------------------------------------------------
# Begin /etc/rsyslog.conf
$ModLoad immark # provides --MARK-- message capability $ModLoad imuxsock #
provides support for local system logging (e.g. via logger command) $ModLoad
imklog # provides kernel logging support (previously done by rklogd)
daemon.* -/var/log/daemon.log
kern.* -/var/log/kern.log
user.* -/var/log/user.log
# Use traditional timestamp format.
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$EscapeControlCharactersOnReceive off
$template RocheSysLog,"%programname% %msg%\n"
#
# Include all config files in /home/roche/etc/rsyslog.d/ # $IncludeConfig
/home/roche/etc/rsyslog.d/*.conf
# allow reading for all users
$FileCreateMode 0644
*.* /home/roche/share/log/syslog
# and disable reading again
$FileCreateMode 0640
# End /etc/rsyslog.conf
------------------------------------ !
rsyslog.conf-----------------------------------------------------------
------------------------------------ /etc/init.d/rsyslogd
-----------------------------------------------------------
#!/bin/sh
#
# rsyslog server
#
PREFIX="rsyslog: "
THISFILE=$0
PIDFILE="/tmp/.rsyslog-lock"
usage() {
echo "${PREFIX}usage: $THISFILE [start|stop]"
}
case $1 in
start)
echo "${PREFIX} starting"
if [ -e "$PIDFILE" ]; then
echo "${PREFIX} another rsyslog server seems to be running,
aborting"
exit 1
else
/usr/sbin/rsyslogd -c5 -f /etc/rsyslog.conf -i $PIDFILE -n
2>/dev/null 1>/dev/null &
fi
;;
stop)
echo "${PREFIX} stopping"
if [ ! -e "$PIDFILE" ]; then
echo "${PREFIX} there seems to be no server running"
exit 1
fi
kill `cat $PIDFILE`
rm -f $PIDFILE
pkill rsyslogd
echo "${PREFIX} done"
;;
*)
usage
exit 1
;;
esac
------------------------------------ ! /etc/init.d/rsyslogd
-----------------------------------------------------------
Best regards
--
Eric
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
