Yes, the ignore is kind of permanent. However, even in inotify mode relatively recent (since 2 yrs ago?) versions of rsyslog also do some polling-like behaviour, so it should recover eventually. But this depends on activity of other monitored files. So if the file with wrong permissions is the only one, it will not recover. It probably is an idea to add a periodically forced poll run.
Rainer El lun, 8 mar 2021 a las 18:28, Andreas Hasenack via rsyslog (<[email protected]>) escribió: > > Hello, > > On Mon, Mar 8, 2021 at 12:58 PM John Chivian <[email protected]> wrote: > > > It might depend on which input mode is being used, inotify (the default > > for the new method of loading the module) or polling (the default for old > > method of loading the module). I would think either would work after the > > scenario described is repaired, but the experts will know for sure. > > > > > I'm using inotify, and haven't seen it recover after a few minutes. A quick > inspection of the code didn't show me a retry mechanism for that either. > Polling I suspect would eventually work again. > > Inotify throws this error (sorry, should have shown this before): > Mar 8 13:57:28 b1 rsyslogd: [origin software="rsyslogd" > swVersion="8.32.0" x-pid="1606" x-info="http://www.rsyslog.com";] start > Mar 8 13:57:28 b1 rsyslogd: imfile: error with inotify API, ignoring file > '/var/log/audit/audit.log': Permission denied [v8.32.0] > I'm wondering if that "ignoring" is permanent, it looks like it is. > _______________________________________________ > rsyslog mailing list > https://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
