Red Hat Bugzilla – Bug 1531295
[RFE]: rsyslog imfile support for symlink wildcard combination
Last modified: 2018-10-31 03:52:51 EDT
Description of problem: - rsyslog stops reading from files via a symlink. Version-Release number of selected component (if applicable): Redhat 7.4 rsyslog-8.24.0-12.el7.x86_64 How reproducible: 100% Steps to Reproduce: 1. configure rsyslog to read docker container logs (refer case linked) 2. rsyslog configured to data to a log database Actual results: rsyslog fails to see the change in the symlinked file. Expected results: rsyslog successfully reads the imfile by looking at what the symlink points to Additional info: Please refer to the case linked for additional data.
This is the link describing the exact problem: https://github.com/rsyslog/rsyslog/issues/2229
The key to knowing if a fix is working is if rsyslog can be configured along side OCP 3.4 and later to watch /var/log/containers/*.log and see that logs continually flow as those log files are created and deleted (some with the same name as they roll over at the 50 MB limit).
The problem is with rsyslog imfile inotify? http://www.rsyslog.com/doc/v8-stable/configuration/modules/imfile.html " mode ["inotify"/"polling"/"fen"] Default: “inotify” Available since: 8.1.5 This specifies if imfile is shall run in inotify (“inotify”) or polling (“polling”) mode. Traditionally, imfile used polling mode, which is much more resource-intense (and slower) than inotify mode. It is suggested that users turn on “polling” mode only if they experience strange problems in inotify mode. In theory, there should never be a reason to enable “polling” mode and later versions will most probably remove it. " Has anyone tried to use `mode polling` as a workaround? I think this qualifies as a "strange" problem.
I don't believe polling mode works with wildcards, see: http://www.rsyslog.com/doc/v8-stable/configuration/modules/imfile.html#caveats-known-bugs
*** Bug 1563409 has been marked as a duplicate of this bug. ***
*** Bug 1563347 has been marked as a duplicate of this bug. ***
The imfile work well with the symlink wildcard. input(type="imfile" file="/var/log/containers/*.log" tag="kubernetes" addmetadata="on") rsyslog-8.24.0-34.el7.x86_64 rsyslog-mmjsonparse-8.24.0-34.el7.x86_64 rsyslog-mmnormalize-8.24.0-34.el7.x86_64 rsyslog-elasticsearch-8.24.0-34.el7.x86_64 rsyslog-mmkubernetes-8.24.0-34.el7.x86_64
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2018:3135