Re: [rsyslog] Timeline for 8.18 release
that reminds me I need to get in a small patch! will do it this morning if it's not too late! On Wed, Apr 13, 2016 at 2:44 AM, Rainer Gerhards wrote: > 2016-04-12 18:31 GMT+02:00 Alec Swan : > > Thanks, Rainer, I was mostly looking at the github repo and missed the > > version field on http://www.rsyslog.com/ > > just FYJ: I use release milestones on github, so you can see it there, > as well. But note that release milestones are a bit earlier (usually > fridays vs. tuesdays) as we need time for final checks and package > building. > > Rainer > > > > > Thanks, > > > > Alec > > > > On Tue, Apr 12, 2016 at 12:38 AM, Rainer Gerhards < > rgerha...@hq.adiscon.com> > > wrote: > > > >> 2016-04-12 3:33 GMT+02:00 David Lang : > >> > I believe it's due out this week. > >> > >> It's always stated in the version box on the rsyslog home page (top > >> right): Apr, 19th is for 8.18. > >> > >> Rainer > >> > > >> > David Lang > >> > > >> > On Mon, 11 Apr 2016, Alec Swan wrote: > >> > > >> >> Is there any approximate date when version 8.18 is expected to go > out? > >> > > >> > ___ > >> > rsyslog mailing list > >> > http://lists.adiscon.net/mailman/listinfo/rsyslog > >> > http://www.rsyslog.com/professional-services/ > >> > What's up with rsyslog? Follow https://twitter.com/rgerhards > >> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > myriad > >> of > >> > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T > >> > LIKE THAT. > >> ___ > >> rsyslog mailing list > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > >> http://www.rsyslog.com/professional-services/ > >> What's up with rsyslog? Follow https://twitter.com/rgerhards > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > >> DON'T LIKE THAT. > >> > > ___ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > ___ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > ___ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: [rsyslog] Imfile $!metadata!filename gets automatically included in $!all-json
On Tue, 12 Apr 2016, Ashish Barmase wrote: Just for fyi. after lots of head-banging, found out, the include *.conf definition (for /etc/rsyslog.d/*)in /etc/rsyslog.conf was the last line. Moving it at top did the trick. the include is very much the same as just putting the included text in the config at that point. As such, the order of includes and where the include is in the config file does matter. David Lang Thanks, Ashish -Original Message- From: rsyslog-boun...@lists.adiscon.com [mailto:rsyslog-boun...@lists.adiscon.com] On Behalf Of David Lang Sent: Tuesday, April 12, 2016 5:54 PM To: rsyslog-users Subject: Re: [rsyslog] Imfile $!metadata!filename gets automatically included in $!all-json On Tue, 12 Apr 2016, Alec Swan wrote: Hi there, Is there a reason why imfile reports file name as $!metadata!filename causing it to be automatically included in $!all-json? All other properties, such as $programname, $hostname, etc., don't start with $! and hence are not automatically included in $!all-json, which I think is the desired behavior. the properties that don't have ! in them all existed before rsyslog had the concept of variables that could be defined. They are legacy oddballs. you can use the set/unset commands to move it wherever you want and remove it from $! tree. David Lang ___ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. ___ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. ___ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: [rsyslog] Files being resent with imfile module on system reboot
I think you need to set workdir. David Lang On Wed, 13 Apr 2016, Joan wrote: Date: Wed, 13 Apr 2016 08:51:03 +0200 From: Joan Reply-To: rsyslog-users To: rsyslog-users Subject: Re: [rsyslog] Files being resent with imfile module on system reboot I didn't specify the workdir variable, I am using the ubuntu ppa, and just using the sane default. I overlooked the PersistStateInterval, it surely will mitigate the issue whenever it repeats. I'll try to see if I can reproduce the behaviour with the shutdown again (it's a production system and I can reboot normally) Thanks a lot 2016-04-12 18:44 GMT+02:00 David Lang : On Tue, 12 Apr 2016, Joan wrote: The files are properly created under /var/spool/rsyslog, unfortunately the timestamp of the file is from the last restart I did. The only strange thing I see, is that apparently rsyslog wasn't notified of the shutdown (ntpd and others left a message). so this is your workdir? It could be that rsyslog is taking too long to shutdown, and so it gets sent a kill -9 and doesn't get a chance to shutdown cleanly. Also, according to http://www.rsyslog.com/doc/v8-stable/configuration/modules/imfile.html PersistStateInterval defaults to 0, so the file is only created at shutdown. If you set it to some non-zero size, it will write the file every X lines, so you won't replay the entire file. I would set this at several hundred to a few thousand to make the overhead of writing the file negligable. David Lang Once the boot finished, the ony information rsyslog left was the following Apr 12 09:02:43 WEBER rsyslogd: [origin software="rsyslogd" swVersion="8.17.0" x-pid="410" x-info="http://www.rsyslog.com";] start Apr 12 09:02:43 WEBER rsyslogd-2007: action 'action 16' suspended, next retry is Tue Apr 12 09:03:13 2016 [v8.17.0 try http://www.rsyslog.com/e/2007 ] Apr 12 09:02:43 WEBER rsyslogd-2307: warning: ~ action is deprecated, consider using the 'stop' statement instead [v8.17.0 try http://www.rsyslog.com/e/2307 ] Apr 12 09:02:43 WEBER rsyslogd: rsyslogd's groupid changed to 104 Apr 12 09:02:43 WEBER rsyslogd: rsyslogd's userid changed to 101 Apr 12 09:03:58 WEBER rsyslogd-2359: action 'action 16' resumed (module 'builtin:omfwd') [v8.17.0 try http://www.rsyslog.com/e/2359 ] Apr 12 09:03:58 WEBER rsyslogd-2359: action 'action 16' resumed (module 'builtin:omfwd') [v8.17.0 try http://www.rsyslog.com/e/2359 ] The only related config I have is this one, it's already with the new syntax, after researching I believed it was ok this way module(load="imfile" mode="inotify" ) input(type="imfile" File="/opt/process/log/*.log" Tag="taskproject:" Facility="local3" ) 2016-04-12 11:21 GMT+02:00 David Lang : what you need to look at is the state file for the file as part of the imfile section. This is probably much clearer with the new syntax available in v7+ David Lang On Tue, 12 Apr 2016, Joan wrote: Date: Tue, 12 Apr 2016 09:56:07 +0200 From: Joan Reply-To: rsyslog-users To: rsyslog-users Subject: [rsyslog] Files being resent with imfile module on system reboot Hello, I am using rsyslog with imfile module to send the contents of a few .log files. I have configured the queue like this: $ActionQueueFileName resender $ActionResumeRetryCount -1 $ActionQueueSaveOnShutdown on Whenever I restart rsyslog, it will know at which point where the logs, and follow from there. The issue is only after rebooting the server. In this case it just flushed all the logs again to the central collector. Did I miss something? ___ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. ___ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. ___ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. ___ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by
[rsyslog] Adiscon rpm down
Hi guys, Anybody else experiencing issues with http://rpms.adiscon.com/ ? It seems to have gone offline somewhere around noon today. Anybody knows a mirror of that? Or any idea what might be the problem? Cheers,Gergo ___ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
