Rsyslog stops sending data to remote server after log rotation

Posted by Vincent B. on Server Fault See other posts from Server Fault or by Vincent B.
Published on 2013-10-21T09:45:58Z Indexed on 2013/10/21 9:57 UTC
Read the original article Hit count: 475

Filed under:
|
|

In my configuration, I have rsyslog who is in charge of following changes of /home/user/my_app/shared/log/unicorn.stderr.log using imfile. The content is sent to another remote logging server using TCP.

When the log file rotates, rsyslog stops sending data to the remote server.

I tried reloading rsyslog, sending a HUP signal and restarting it altogether, but nothing worked.

The only ways I could find that actually worked were dirty:

  • stop the service, delete the rsyslog stat files and start rsyslog again. All that in a postrotate hook in my logrotate file.
  • kill -9 rsyslog and start it over.

Is there a proper way for me to do this without touching rsyslog internals?

Rsyslog file

$ModLoad immark
$ModLoad imudp
$ModLoad imtcp
$ModLoad imuxsock
$ModLoad imklog
$ModLoad imfile

$template WithoutTimeFormat,"[environment] [%syslogtag%] -- %msg%"

$WorkDirectory /var/spool/rsyslog

$InputFileName /home/user/my_app/shared/log/unicorn.stderr.log
$InputFileTag unicorn-stderr
$InputFileStateFile stat-unicorn-stderr
$InputFileSeverity info
$InputFileFacility local8
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
$InputRunFileMonitor

# Forward to remote server
if $syslogtag contains 'apache-' then @@my_server:5000;WithoutTimeFormat
:syslogtag, contains, "apache-" ~

*.* @@my_server:5000;SyslFormat

Logrotate file

/home/user/shared/log/*.log {
  daily
  missingok
  dateext
  rotate 30
  compress
  notifempty
  extension gz
  copytruncate
  create 640 user user
  sharedscripts
  post-rotate
    (stop rsyslog && rm /var/spool/rsyslog/stat-* && start rsyslog 2>&1) || true
  endscript
}

FYI, the file is readable for the rsyslog user, my server is reachable and other log files which do not rotate on the same cycle continue to be tracked properly.

I'm running Ubuntu 12.04.

© Server Fault or respective owner

Related posts about linux

Related posts about logrotate