could you check if that's an incompatibility with inotify mode. To do so, just add
mode="polling" to the module definition. Rainer 2014-10-17 13:32 GMT+02:00 Radu Gheorghe <[email protected]>: > Hello, > > I was just testing an rsyslog 8.4.2 with our Logsene and I didn't > understand why I couldn't see no logs from the tailed files. The problem > seems to be that, with ReadMode set to 2, imfile doesn't pass events on no > matter what you put in the file. > > I always see this in the debug log and nothing else: > > 3954.342512201:imfile.c : DDDD: imfile: wd 3 got file 1, dir -1 > 3954.342522434:imfile.c : strm 0x7fc6e00045b0: file 7 read 9 bytes > 3954.342528353:imfile.c : strm 0x7fc6e00045b0: file 7 read 0 bytes > 3954.342537453:imfile.c : stream checking for file change on > '/var/log/cassandra/system.log', inode 263735/263735 > 3962.854107352:imfile.c : DDDD: imfile event notification: rd 16[0], > wd (3, mask 00000002, cookie 0000, len 0) > 3962.854124058:imfile.c : watch was MODIFID > > For reference, here's a complete configuration that normally works with > Logsene: > > module(load="imfile") > > input(type="imfile" > File="/var/log/cassandra/system.log" > Tag="cassandra-system:" > StateFile="cassandra-system" > ReadMode="2") > > *.* @@logsene-receiver-syslog.sematext.com;RSYSLOG_SyslogProtocol23Format > > As soon as I set ReadMode to the default 0, things work as expected (logs > are forwarded all the way). > > Does anyone else experience this issue? It may be recently introduced, > because I tested various versions and I never had this problem. And I was > always using ReadMode 2. > > Best regards, > Radu > -- > Performance Monitoring * Log Analytics * Search Analytics > Solr & Elasticsearch Support * http://sematext.com/ > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
