[rsyslog] rsyslog not working after receiving HUP signal

2012-12-18 Thread Arnau Bria
Hi all, I've some SL 6.3 hosts and I'm noticing that some of them have some problems with rsyslog. After they rotate its logs, and they recieve HUP signal, I have no more info in messages log file: # cat /etc/logrotate.d/syslog /var/log/cron /var/log/maillog /var/log/messages /var/log/secure

Re: [rsyslog] rsyslog not working after receiving HUP signal

2012-12-18 Thread Radu Gheorghe
Hi, I'm not sure what HUP does in 5.8, but maybe someone else can shed some light on this. I think it would help to share the piece of the debug log that shows what's happening when you do a HUP on your machine. Also, a workaround would be to restart rsyslog instead of sending HUP to it. Best

Re: [rsyslog] imfile and omudpspoof

2012-12-18 Thread Rainer Gerhards
-Original Message- From: rsyslog-boun...@lists.adiscon.com [mailto:rsyslog- boun...@lists.adiscon.com] On Behalf Of David Lang Sent: Tuesday, December 18, 2012 2:22 AM To: rsyslog-users Subject: Re: [rsyslog] imfile and omudpspoof By the way, as the original author of omudpspoof,

Re: [rsyslog] rsyslog not working after receiving HUP signal

2012-12-18 Thread Rainer Gerhards
Are you dropping privileges? A common mistake is to use wrong file permissions, and this leads to exactly what you describe. Rainer -Original Message- From: rsyslog-boun...@lists.adiscon.com [mailto:rsyslog- boun...@lists.adiscon.com] On Behalf Of Radu Gheorghe Sent: Tuesday,

Re: [rsyslog] rsyslog not working after receiving HUP signal

2012-12-18 Thread Arnau Bria
On Tue, 18 Dec 2012 09:10:10 + Rainer Gerhards wrote: Hi, Are you dropping privileges? A common mistake is to use wrong file permissions, and this leads to exactly what you describe. Rainer nope. # grep -ir drop /etc/rsyslog* # I run it as root. root 26641 1 0 Dec17 ?

Re: [rsyslog] rsyslog not working after receiving HUP signal

2012-12-18 Thread Rainer Gerhards
-Original Message- From: rsyslog-boun...@lists.adiscon.com [mailto:rsyslog- boun...@lists.adiscon.com] On Behalf Of Arnau Bria Sent: Tuesday, December 18, 2012 10:30 AM To: rsyslog@lists.adiscon.com Subject: Re: [rsyslog] rsyslog not working after receiving HUP signal On Tue, 18

Re: [rsyslog] rsyslog not working after receiving HUP signal

2012-12-18 Thread Arnau Bria
On Tue, 18 Dec 2012 09:42:52 + Rainer Gerhards wrote: Hi, I am sorry, but v5 is way beyond end of life. Please check if the problem persist with 7.2.4. Well, this is Scientific Linux 6.3 default version. I'd prefer SL to update the package before doing it by my side. (my pc runs fc17 and

Re: [rsyslog] rsyslog not working after receiving HUP signal

2012-12-18 Thread Andre Lorbach
Let me say that I tried rsyslog.repo (http://rpms.adiscon.com/v7-stable/rsyslog.repo) and it is not valid: # yum update rsyslog Loaded plugins: priorities, protectbase, refresh-packagekit, security http://rpms.adiscon.com/v7-stable/epel- 6/x86_64/RPMS/repodata/repomd.xml: [Errno 14] PYCURL

Re: [rsyslog] rsyslogd buffering logs?

2012-12-18 Thread Philippe Muller
Hello, Trying to understand rsyslog behavior with that sample config: - If loghost.unet.brandeis.edu is down, messages will pile up in the main queue (because the TCP action has a direct queue by default) - Once the main queue is full, rsyslog will no longer poll /dev/log - Now, rsyslog will no

Re: [rsyslog] rsyslogd buffering logs?

2012-12-18 Thread bodik
Is that the expected behavior of rsyslog with that configuration ? I believe it is. http://www.rsyslog.com/doc/queues.html How can we configure the TCP action in order to prevent the complete locking ? http://www.rsyslog.com/doc/rsyslog_reliable_forwarding.html beside what's written

Re: [rsyslog] rsyslogd buffering logs?

2012-12-18 Thread David Lang
On Tue, 18 Dec 2012, bodik wrote: Is that the expected behavior of rsyslog with that configuration ? I believe it is. http://www.rsyslog.com/doc/queues.html Yes. note that this is not a new failure that rsyslog introduces, it's the standard behavior that syslog has had all along. With

Re: [rsyslog] rsyslogd buffering logs?

2012-12-18 Thread bodik
#forward1 $ActionQueueType LinkedList# use asynchronous processing $ActionQueueFileName srvrfwd1 # set file name, also enables disk mode $ActionResumeRetryCount -1 # infinite retries on insert failure $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog

Re: [rsyslog] rsyslogd buffering logs?

2012-12-18 Thread David Lang
On Tue, 18 Dec 2012, bodik wrote: #forward1 $ActionQueueType LinkedList# use asynchronous processing $ActionQueueFileName srvrfwd1 # set file name, also enables disk mode $ActionResumeRetryCount -1 # infinite retries on insert failure $ActionQueueSaveOnShutdown on #

Re: [rsyslog] rsyslogd buffering logs?

2012-12-18 Thread Rainer Gerhards
-Original Message- From: rsyslog-boun...@lists.adiscon.com [mailto:rsyslog- boun...@lists.adiscon.com] On Behalf Of David Lang Sent: Tuesday, December 18, 2012 2:22 PM To: rsyslog-users Subject: Re: [rsyslog] rsyslogd buffering logs? On Tue, 18 Dec 2012, bodik wrote:

[rsyslog] rsyslogd 7.2.4-1.el6 and selinux

2012-12-18 Thread Sven Hergenhahn
Hi, Rainer helped me with a filter problem and had me upgrade to 7.2.4, but now my forwarding does not work anymore due to selinux problems. I installed the RPM for Centos/RHEL 6. With selinux enabled, nothing gets logged, and as soon as I setenforce0 and restart rsyslogd everything is OK.

Re: [rsyslog] rsyslog not working after receiving HUP signal

2012-12-18 Thread Arnau Bria
On Tue, 18 Dec 2012 12:39:41 + Andre Lorbach wrote: Let me say that I tried rsyslog.repo (http://rpms.adiscon.com/v7-stable/rsyslog.repo) and it is not valid: # yum update rsyslog Loaded plugins: priorities, protectbase, refresh-packagekit, security