rsyslog appears to act on old configuration

Question

I'm using a template to dynamically generate rsyslog filenames. I've made some changes from my original format, but rsyslog still appears to be using both the new template and the old after restarting.

My filename template went from this:

$template RemoteDailyLog,"/var/log/remote/%hostname%/%$year%/%$month%/%$day%.log"

To this:

$template RemoteDailyLog,"/var/log/remote/%hostname%/%fromhost-ip%/%$year%/%$month%/%$day%.log"

I stopped rsyslogd using service rsyslog stop, deleted all of my log files using rm -rf /var/log/remote/*, and then restarted rsyslogd with service rsyslog start.

The problem is rsyslog seems to be building folder structures of the type "/var/log/remote/%hostname%/%$year%/%$month%/%$day%.log" (i.e., without the remote IP), which no longer appears anywhere in my configuration.

Is it possible that old log or config data have been cached somewhere and are being preserved through the server restart? This is creeping me out a little.

Answer 1

This problem resolved itself after fixing a related issue I was having with rsyslog. I'm not sure how it's relevant, but if rsyslog is having issues opening dynamic log files, it appears to have some erratic behavior with regard to past configurations. Anyway, here's a reprint of my solution:

After examining the server's /var/log/syslog, I discovered that rsyslog was having problems opening dynamic files. It turns out that the default Ubuntu 10.04 LTS config for rsyslog is not adequate for dynamic (template-based) log files. The proposed patch, due to Richard Fleming, is as follows:

--- /etc/rsyslog.conf.orig  2009-11-17 11:21:10.874573462 -0500
+++ /etc/rsyslog.conf   2009-11-17 12:45:15.604573200 -0500
@@ -42,9 +42,11 @@
 $FileGroup adm
 $FileCreateMode 0640
 $DirCreateMode 0755
+$DirOwner syslog
+$DirGroup adm
 $Umask 0022
 $PrivDropToUser syslog
-$PrivDropToGroup syslog
+$PrivDropToGroup adm

 #
 # Include all config files in /etc/rsyslog.d/

For more information, see: https://bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/484336