RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1531295 - [RFE]: rsyslog imfile support for symlink wildcard combination
Summary: [RFE]: rsyslog imfile support for symlink wildcard combination
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: rsyslog
Version: 7.4
Hardware: All
OS: Unspecified
urgent
urgent
Target Milestone: rc
: ---
Assignee: Jiří Vymazal
QA Contact: Noriko Hosoi
Mirek Jahoda
URL:
Whiteboard:
: 1563347 1563409 (view as bug list)
Depends On: 1601928
Blocks: 1477664 1563347 1563409 1614179
TreeView+ depends on / blocked
 
Reported: 2018-01-04 23:00 UTC by Ruchika K
Modified: 2021-06-10 14:06 UTC (History)
17 users (show)

Fixed In Version: rsyslog-8.24.0-34.el7
Doc Type: Enhancement
Doc Text:
*rsyslog* `imfile` now supports symlinks With this update, the *rsyslog* `imfile` module delivers better performance and more configuration options. This enables to use the module for more complicated file monitoring use cases. Users of *rsyslog* are now able to use file monitors with glob patterns anywhere along the configured path and rotate symlink targets with increased data throughput when compared to the previous version.
Clone Of:
: 1563347 1614179 (view as bug list)
Environment:
Last Closed: 2018-10-30 10:17:00 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github rsyslog rsyslog issues 2229 0 None closed make imfile support symlinks in monitored directories (requires some polling) 2020-11-12 01:58:43 UTC
Github rsyslog rsyslog pull 2749 0 None closed Symlink support for imfile 2020-11-12 01:58:24 UTC
Github rsyslog rsyslog pull 2914 0 None closed Enhanced symlink rotation support 2020-11-12 01:58:24 UTC
Github rsyslog rsyslog pull 2952 0 None closed Fixed parent name when processing symlinks 2020-11-12 01:58:24 UTC
Red Hat Bugzilla 1602156 0 unspecified CLOSED imfile symlink uses source filename in metadata filename instead of given name 2021-02-22 00:41:40 UTC
Red Hat Bugzilla 1644547 0 unspecified CLOSED [RFE] Implement directory wildcards in rsyslog 2021-12-10 18:06:50 UTC
Red Hat Bugzilla 1649250 0 high CLOSED rsyslog-8.24.0-34.el7.x86_64 imfile broken with logrotate and tomcat rotated logs 2022-03-13 16:03:06 UTC
Red Hat Product Errata RHEA-2018:3135 0 None None None 2018-10-30 10:19:08 UTC

Internal Links: 1602156 1644547 1649250

Description Ruchika K 2018-01-04 23:00:19 UTC 
Description of problem:
- rsyslog stops reading from files via a symlink.

Version-Release number of selected component (if applicable):

Redhat 7.4
rsyslog-8.24.0-12.el7.x86_64


How reproducible:
100%

Steps to Reproduce:
1. configure rsyslog to read docker container logs (refer case linked)
2. rsyslog configured to data to a log database


Actual results:
rsyslog fails to see the change in the symlinked file.

Expected results:
rsyslog successfully reads the imfile by looking at what the symlink points to 

Additional info:

Please refer to the case linked for additional data.
Comment 2 Ruchika K 2018-01-04 23:12:04 UTC 
This is the link describing the exact problem: https://github.com/rsyslog/rsyslog/issues/2229
Comment 3 Peter Portante 2018-01-04 23:16:35 UTC 
The key to knowing if a fix is working is if rsyslog can be configured along side OCP 3.4 and later to watch /var/log/containers/*.log and see that logs continually flow as those log files are created and deleted (some with the same name as they roll over at the 50 MB limit).
Comment 13 Rich Megginson 2018-01-18 20:49:20 UTC 
The problem is with rsyslog imfile inotify?

http://www.rsyslog.com/doc/v8-stable/configuration/modules/imfile.html

" mode ["inotify"/"polling"/"fen"]

        Default: “inotify”

        Available since: 8.1.5

    This specifies if imfile is shall run in inotify (“inotify”) or polling (“polling”) mode. Traditionally, imfile used polling mode, which is much more resource-intense (and slower) than inotify mode. It is suggested that users turn on “polling” mode only if they experience strange problems in inotify mode. In theory, there should never be a reason to enable “polling” mode and later versions will most probably remove it.
"

Has anyone tried to use `mode polling` as a workaround?  I think this qualifies as a "strange" problem.
Comment 14 Peter Portante 2018-01-19 01:54:33 UTC 
I don't believe polling mode works with wildcards, see: http://www.rsyslog.com/doc/v8-stable/configuration/modules/imfile.html#caveats-known-bugs
Comment 22 Jiří Vymazal 2018-04-04 13:36:08 UTC 
*** Bug 1563409 has been marked as a duplicate of this bug. ***
Comment 23 Jiří Vymazal 2018-04-05 05:41:49 UTC 
*** Bug 1563347 has been marked as a duplicate of this bug. ***
Comment 113 Anping Li 2018-09-04 17:30:09 UTC 
The imfile work well with the symlink wildcard. 
input(type="imfile" file="/var/log/containers/*.log" tag="kubernetes" addmetadata="on")

rsyslog-8.24.0-34.el7.x86_64
rsyslog-mmjsonparse-8.24.0-34.el7.x86_64
rsyslog-mmnormalize-8.24.0-34.el7.x86_64
rsyslog-elasticsearch-8.24.0-34.el7.x86_64
rsyslog-mmkubernetes-8.24.0-34.el7.x86_64
Comment 117 errata-xmlrpc 2018-10-30 10:17:00 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2018:3135
Note You need to log in before you can comment on or make changes to this bug.