New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
imfile-state files are not removed #4186
Comments
At the bottom, this is a feature. I am not sure if we added a config option to turn it off. Here it is why we do not delete state files: we have many users who move log files around, even between monitored locations. They do not want rsyslog to re-sent data already sent from a different location. Thus we need to keep the state file as we never know when and where the original log file is moved in again. That said, I think I remember a request to make this configurable. @jvymazal do you know it our of your head? |
So what should we do with that files? When can they securly be deleted? We have servers who generes 20k of this files each day. |
We can implement a workaround like a cron, which deletes the files every 5 min, when they are older then a few minutes. But how do we know if that would not break stuff for rsyslog? |
They were created with the 8.2001.0 version. We did it on fresh installed mashines |
also @rgerhards it is indeed configurable, see https://www.rsyslog.com/doc/v8-stable/configuration/modules/imfile.html#deletestateonfiledelete but by default it is on meaning that rsyslog should actually delete the files. |
We will try to explicite enable it. And then all the files should be deleted or do we need already existing files. |
Ok, now that I am thinking about it more, @dwerder are you seding HUP to rsyslog upon file rotations? If not, and you did not configure forced |
Also, as for the old files, if rsyslog is restarted and did not delete them than it will never delete them so you have to do it manually (the older hashes are not persisted anywhere) |
Hello @jvymazal . We tried it with the kill Hup First we used inotify and saw that the files are still created and we see that warning on each HUP.
When we use polling, we don't see the warning. But files are created as before.
-rw------- 1 root root 1331 Feb 26 13:54 imfile-state:2503:2af90740afcd4e76
-rw------- 1 root root 2068 Feb 26 13:54 imfile-state:2521:974ea1fc83d42e97
-rw------- 1 root root 2251 Feb 26 13:54 imfile-state:2503:32ae111acde701ba
-rw------- 1 root root 1991 Feb 26 13:54 imfile-state:2521:d57cd2f52023a64f
-rw------- 1 root root 1747 Feb 26 13:55 imfile-state:2503:3e89dfd92e1c4d8d
-rw------- 1 root root 814 Feb 26 13:55 imfile-state:2521:885f498b07e065ec
-rw------- 1 root root 3546 Feb 26 13:55 imfile-state:2503:a62f83617e475762
-rw------- 1 root root 664 Feb 26 13:55 imfile-state:2521:1ca4b607bb96ae0d
-rw------- 1 root root 3779 Feb 26 13:55 imfile-state:2503:47a09a7394e9ef22
-rw------- 1 root root 1070 Feb 26 13:56 imfile-state:2521:a3ebf4ae3f0310b5
-rw------- 1 root root 2220 Feb 26 13:56 imfile-state:2503:968f398d61b69416
-rw------- 1 root root 1015 Feb 26 13:56 imfile-state:2521:ef3f47f8c85e2539
-rw------- 1 root root 2231 Feb 26 13:56 imfile-state:2503:0ecacc5b15470d9b
-rw------- 1 root root 544 Feb 26 13:56 imfile-state:2521:049e49fb20319368 I like to mention that it is one log file and it is rotate multiple times within a minute. |
@rgerhards please correct me if I am wrong but sending HUP should force persisting of imfile statefiles, right? |
@jvymazal think so, but not 100% sure - sorry, heading from teleconf to teleconf today... Will check ASAP. |
i am also hit this issue with version 8.2002.0 .
|
Would you please also post relevant configuration snippet you use in reproducing? Thanks |
i am add my own configuration in /etc/rsyslog.d directory. the configure file is like this (it is syslogmgr-collect.conf, but can't upload, so i change to text format) and, the rsyslog process is always running , NO excute stop/restart/kill/...... operation. |
May thanks for info, I will look into it once I have a moment. |
@jvymazal ,do you have any update on this issue ? |
I'm running into this as well. A slew of versions but using Ubuntu: No state file surprisingly but behaving as it should: State file behaving as it should:
Problem started:
I have debug output if desired. Current for 8.2112.0 but if it would help for another version, let me know and I can do that for you. This became an issue as we use rsyslog to process and send auditd (i.e. linux-audit) logs. Some of our servers have a lot of activity and this caused us to run out of inodes. Very rare overall but a thing I'm sure many Linux admins do. There used to be an rsyslog wiki page which showed how to use rsyslog for auditd logging. That's pretty much our setup. I don't have that link anymore but it's probably going to be similar to this. We use UDP but pretty much the same setup. https://linux-audit.com/central-audit-logging-configuration-collecting-linux-audit-events/ |
I have noticed that the https://github.com/rsyslog/rsyslog/blob/master/plugins/imfile/imfile.c#L1063 In the
However
Here via I found this to be similar - updated a month ago - trying to see if this will work: #5258 |
The fix used in #5258 did not work for me. Stale files are still left and the unlink call is not given the right argument. |
I am also hit this issue with version 8.2312.0. |
Expected behavior
imfile-state:<inode>:<hash> files should be deleted if logfile is rotated/changed
Actual behavior
imfile-state files are not deleted.
Steps to reproduce the behavior
Install rsyslog version 8.2001.0-3 and have fast rotated log files. Also we see that our logs always switch just a few inode (don't know if that info helps)
Since merge of #3990 we do not have the problems that log entries are resend, but we have servers with thousends and thousends of that imfile-state files.
Environment
The text was updated successfully, but these errors were encountered: