Description of problem:
- rsyslog stops reading from files via a symlink.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. configure rsyslog to read docker container logs (refer case linked)
2. rsyslog configured to data to a log database
rsyslog fails to see the change in the symlinked file.
rsyslog successfully reads the imfile by looking at what the symlink points to
Please refer to the case linked for additional data.
This is the link describing the exact problem: https://github.com/rsyslog/rsyslog/issues/2229
The key to knowing if a fix is working is if rsyslog can be configured along side OCP 3.4 and later to watch /var/log/containers/*.log and see that logs continually flow as those log files are created and deleted (some with the same name as they roll over at the 50 MB limit).
The problem is with rsyslog imfile inotify?
" mode ["inotify"/"polling"/"fen"]
Available since: 8.1.5
This specifies if imfile is shall run in inotify (“inotify”) or polling (“polling”) mode. Traditionally, imfile used polling mode, which is much more resource-intense (and slower) than inotify mode. It is suggested that users turn on “polling” mode only if they experience strange problems in inotify mode. In theory, there should never be a reason to enable “polling” mode and later versions will most probably remove it.
Has anyone tried to use `mode polling` as a workaround? I think this qualifies as a "strange" problem.
I don't believe polling mode works with wildcards, see: http://www.rsyslog.com/doc/v8-stable/configuration/modules/imfile.html#caveats-known-bugs
*** Bug 1563409 has been marked as a duplicate of this bug. ***
*** Bug 1563347 has been marked as a duplicate of this bug. ***
The imfile work well with the symlink wildcard.
input(type="imfile" file="/var/log/containers/*.log" tag="kubernetes" addmetadata="on")
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.