Linux_Programmer
New Member
On SLES12, rsyslog doesn't invoke logrotation script upon logfile size exceeding the threshold.
In the below given example, sometimes rotation script is invoked at 21MB, or 22 MB.
$outchannel logRot_node1_msg,/var/log/messages, 20480000,/usr/local/bin/logrotate.sh
When the logging rate is very high, it doesn't invoke logrotate.sh script even after /var/log/messages file size exceeds 35 MB.
my-Linux-System:/var/log/# ls -lrt
-rw-r--r-- 1 root root 2914465 Aug 4 04:56 messages.3.gz
-rw-r--r-- 1 root root 1636058 Aug 4 05:12 messages.2.gz
-rw-r--r-- 1 root root 1805296 Aug 4 05:25 messages.1.gz
-rw-r--r-- 1 root root 1052839 Aug 4 05:35 kernel
-rw-r--r-- 1 root root 424437 Aug 4 05:53 systemd
-rw-r--r-- 1 root root 7451121 Aug 4 05:53 auth
-rw-r--r-- 1 root root 37861587 Aug 4 05:53 messages
Only after restarting rsyslogd, messages file gets rotated as logrotate.sh gets invoked by the new rsyslogd process upon start.
Queries:
1) Is there any issue with rsyslog in SLES12 wrt invoking rotation scripts ?
2) Does high logging rate (say 60-70 logs/sec) has any impact on rsyslog processing that it doesn't check for the file size thresholds ?
3) Is there any workaround to make rsyslog work as expected without restarting rsyslogd ?
In the below given example, sometimes rotation script is invoked at 21MB, or 22 MB.
$outchannel logRot_node1_msg,/var/log/messages, 20480000,/usr/local/bin/logrotate.sh
When the logging rate is very high, it doesn't invoke logrotate.sh script even after /var/log/messages file size exceeds 35 MB.
my-Linux-System:/var/log/# ls -lrt
-rw-r--r-- 1 root root 2914465 Aug 4 04:56 messages.3.gz
-rw-r--r-- 1 root root 1636058 Aug 4 05:12 messages.2.gz
-rw-r--r-- 1 root root 1805296 Aug 4 05:25 messages.1.gz
-rw-r--r-- 1 root root 1052839 Aug 4 05:35 kernel
-rw-r--r-- 1 root root 424437 Aug 4 05:53 systemd
-rw-r--r-- 1 root root 7451121 Aug 4 05:53 auth
-rw-r--r-- 1 root root 37861587 Aug 4 05:53 messages
Only after restarting rsyslogd, messages file gets rotated as logrotate.sh gets invoked by the new rsyslogd process upon start.
Queries:
1) Is there any issue with rsyslog in SLES12 wrt invoking rotation scripts ?
2) Does high logging rate (say 60-70 logs/sec) has any impact on rsyslog processing that it doesn't check for the file size thresholds ?
3) Is there any workaround to make rsyslog work as expected without restarting rsyslogd ?