Bug 1411695

Summary: Buffering in omfile flushing incomplete messages [ rsyslog v8 ]
Product: Red Hat Enterprise Linux 7 Reporter: Jiří Vymazal <jvymazal>
Component: rsyslogAssignee: Jiří Vymazal <jvymazal>
Status: CLOSED UPSTREAM QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 7.4CC: rsroka, sdordevi
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-01-12 07:27:14 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1313490    
Bug Blocks: 1408473    
Attachments:
Description Flags
proposed patch none

Description Jiří Vymazal 2017-01-10 10:21:08 UTC 
Created attachment 1239043 [details]
proposed patch

Description of problem:
After solving https://bugzilla.redhat.com/show_bug.cgi?id=1399569 there remains the original issue where in case of flushOnTXEnd switch OFF omfile would upon reaching buffer size limit flush only buffer size thus leaving incomplete message in log file. Proposed patches solves this, also sent upstream (see linked GitHub issue)

Version-Release number of selected component (if applicable):
rsyslog-8.23.0-5.fc25.x86_64

How reproducible:
always

Steps to Reproduce:
1. put "local0.info action(type="omfile" file="/var/log/rsyslog.test.log" IOBufferSize="1k" FlushOnTXEnd="off")" into rsyslog.conf file
2. log enough messages with -p local0.info to reach buffer size
3. look at /var/log/rsyslog.test.log 

Actual results:
last flushed message is incomplete

Expected results:
all flushed messages are complete

Additional info:
Comment 2 Jiří Vymazal 2017-01-12 07:27:14 UTC 
I communicated with upstream that with this combination of switches the partial lines writing is actually intended behavior because of performance reasons, see https://github.com/rsyslog/rsyslog/pull/1353#issuecomment-271910634. Closing, if need from customer or somebody has other problems with this behavior, please reopen.