Restarting rsyslog re-sends logs again

Posted by Jay Taylor on Server Fault See other posts from Server Fault or by Jay Taylor
Published on 2012-12-11T23:22:25Z Indexed on 2012/12/19 11:04 UTC
Read the original article Hit count: 271

Filed under:

ubuntu-12.04

|

rsyslog

I am running Ubuntu 12.04.1 LTS on EC2. I have a bunch of application servers which are configured to forward their logs to a central server via rsyslog.

Since putting in Nagios monitoring on the log files on the central server, I've been getting alerts indicating that particular application servers are failing to forward their logs to the centralized server.

Logging into the machines and restarting the rsyslog service fixes the problem. However, rsyslog then re-transmits the logs again, resulting in duplicates on the collector. Why is it doing this?

© Server Fault or respective owner

Related posts about ubuntu-12.04

How to Upgrade Ubuntu 12.04.2 to Ubuntu 12.04.3

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I am currently using Ubuntu 12.04.2 32bit. I installed it using LiveCD. Tomorrow, 23rd August 2013,Ubuntu 12.04.3 is released. I want to upgrade from Ubuntu 12.04.2 to Ubuntu 12.04.3 without using any LiveCD. Is it possible? If so please suggest me how can I do. Actually while using Ubuntu 12.04… >>> More
Download the ‘Getting Started with Ubuntu 12.04' Manual for Free

as seen on How to geek - Search for 'How to geek'
If you or someone you know is new to Ubuntu, then the release of this free 143 page manual for the latest LTS edition of Ubuntu is the perfect download. The manual will take you from installing Ubuntu 12.04 all the way through to trouble-shooting the system if you run into problems. On the downloads… >>> More
Ubuntu 12.04.1 Radeon 9550 stuck with 640x480, works in Geexbox

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I am a complete new user trying to set up Ubuntu on an old desktop. It has an AGP Radeon 9550 graphics card. I am running Ubuntu from a USB drive with persistence as the PC currently has no hard drive I seem to be stuck in 640*480 mode. The desktop itself is larger, but the monitor display is stuck… >>> More
Ubuntu 12.04.1 desktop monitor Out of Range

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I know this question has been asked many-a-times, but I cant seem to get a definate answer to it. I am running Ubuntu 12.04.1 LTS on my HP Pavillion a6 109n PC. Processor is a AMD Athlon 64 x2 Dual core Processor. Everytime I boot up my desktop, it runs BIOS, then it boots up Linux. After about… >>> More
Key-Based SSH Permission denied (publickey) Ubuntu 12-04

as seen on Server Fault - Search for 'Server Fault'
I have configured sshd to accept key-based ssh logins with LogLevel on DEBUG, and uploaded my public key to ~/.ssh.authorized_keys, where permissions are set as: 700 ~/.ssh 600 ~/.ssh/authorized_keys From root, I can su - USERNAME. From the client I get Permission denied (publicly). From the server… >>> More

Related posts about rsyslog

How to start up rsyslog automatically?

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
Check current status of rsyslog $ chkconfig --list rsyslog rsyslog 0:off 1:off 2:off 3:off 4:off 5:off 6:off Start up rsyslog at some levels $ sudo chkconfig --level 35 rsyslog on It outputs these information: insserv: warning: script 'plymouth-stop' missing LSB tags… >>> More
rsyslog channels change ownership from root

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
Hello all I am using rsyslog on ubuntu 10.4 64bit LTS. the following is the relevant config in /etc/rsyslog.d/60-mylogger.conf $template Paul,"%msg%\n" $outchannel log_rotation_paul,/var/log/paul/events.log,2000,/opt/scripts/log_rotation_script.sh local0.* $log_rotation_paul;Paul This… >>> More
Rsyslog stops sending data to remote server after log rotation

as seen on Server Fault - Search for 'Server Fault'
In my configuration, I have rsyslog who is in charge of following changes of /home/user/my_app/shared/log/unicorn.stderr.log using imfile. The content is sent to another remote logging server using TCP. When the log file rotates, rsyslog stops sending data to the remote server. I tried reloading… >>> More
Does the ``-'' sign have meaning in rsyslog.conf

as seen on Server Fault - Search for 'Server Fault'
Rsyslog is backwards-compatible with Syslog configuration files. The syslog.conf man page has: You may prefix each entry with the minus ``-'' sign to omit syncing the file after every logging. Note that you might lose information if the system crashes right behind a write attempt. Nevertheless… >>> More
Rsyslog to get logs from one machine to another

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi I am very new to this... please help me configure rsyslog to get log from one machine to another machine. I am trying to get the log files from multiple systems to a base system. I have installed rsyslog on Ubuntu and tried configuring it But it did not work >>> More