Hello Tomasz, this seems to be related to change in 8.26 about the error reporting. https://github.com/rsyslog/rsyslog/blob/master/ChangeLog
Read comments for 8.26 version and "- enable internal error messages at all times". This is the reason why you do see messages which were not seen with previous rsyslog versions. -- Peter On Sat, Apr 8, 2017 at 1:44 PM, Tomasz Chmielewski via rsyslog <[email protected]> wrote: > On 2017-04-08 20:11, Rainer Gerhards wrote: >> >> It is generally a good idea to enable impstats to check where exactly >> queues build up (and how large they grow). Based on that information, >> we can evaluate if it just is a config issue or indeed a memory leak >> (as david said, none is currently known). > > > I think I've found where the problem is. > > We use the same config file for several servers. It reads around 40 > logsfiles and sends them to one or two remote destinations, depending on the > logfile. > > Now, the server where rsyslogd wass using gigabytes of RAM after rsyslogd > upgrade (I think to 8.26), also used the same config file the other servers > use, however, it only has 6 or so of these logfiles - the rest of them do > not exist. > > Example entry for a logfile which may or may not exist on a given server: > > # /var/www/website/core/logs/pagenotfound.log > input(type="imfile" File="/var/www/website/core/logs/pagenotfound.log" > Tag="pagenotfound.log") > if $programname == 'pagenotfound.log' then { > action(type="omfwd" Target="graylog01" Port="9514" Protocol="tcp") > action(type="omfwd" Target="log01" Port="514" Protocol="tcp") > stop > } > > > So rsyslogd reports this to /var/log/rsyslogd.log in huge quantities, > gigabytes a day (previous versions were not reporting it, with the same > configuration): > > Apr 8 11:38:18 work01.sys.timedoctor.com rsyslogd: file > '/var/log/nginx/website.access.log': open error: No such file or directory > [v8.26.0 try http://www.rsyslog.com/e/2040 ] > Apr 8 11:38:18 work01.sys.timedoctor.com rsyslogd: file > '/var/log/nginx/website.access.log': open error: No such file or directory > [v8.26.0 try http://www.rsyslog.com/e/2040 ] > Apr 8 11:38:18 work01.sys.timedoctor.com rsyslogd: file > '/var/log/nginx/website.error.log': open error: No such file or directory > [v8.26.0 try http://www.rsyslog.com/e/2040 ] > Apr 8 11:38:18 work01.sys.timedoctor.com rsyslogd: file > '/var/log/nginx/website.error.log': open error: No such file or directory > [v8.26.0 try http://www.rsyslog.com/e/2040 ] > Apr 8 11:38:18 work01.sys.timedoctor.com rsyslogd: file > '/var/www/website/core/cache/logs/error.log': open error: No such file or > directory [v8.26.0 try http://www.rsyslog.com/e/2040 ] > Apr 8 11:38:18 work01.sys.timedoctor.com rsyslogd: file > '/var/www/website/core/cache/logs/error.log': open error: No such file or > directory [v8.26.0 try http://www.rsyslog.com/e/2040 ] > Apr 8 11:38:18 work01.sys.timedoctor.com rsyslogd: file > '/var/www/website/core/logs/pagenotfound.log': open error: No such file or > directory [v8.26.0 try http://www.rsyslog.com/e/2040 ] > Apr 8 11:38:18 work01.sys.timedoctor.com rsyslogd: file > '/var/www/website/core/logs/pagenotfound.log': open error: No such file or > directory [v8.26.0 try http://www.rsyslog.com/e/2040 ] > > > At the same time, rsyslogd memory usage grows to gigabytes (previous > versions were not using gigabytes of RAM, if the logfiles did not exist). > > > When I removed the nonexisting files from the config file, memory usage > stays more or less the same, about 330 MB. > > > So, not sure if it's a bug or a feature. > > > > Tomasz Chmielewski > https://lxadm.com > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
