I'm using rsyslog 8.36.0 version on CS6.0 . I have an application which writes to a file "/tmp/1". This file gets overwritten everytime the application runs (every 20mins/30mins).

We want rsyslog to read this file using imfile. The issue we are facing here is that, rsyslog reads full file initially and sends to /var/log/messages. Then when there are updates to the file where character count is less than the previous , rsyslog will not read that file/will not send it to /var/log/messages.

For Ex: 1st time below full line is sent to /var/log/messages: "rsyslog is used for logging"

Next, below message is not sent as it has less character count or offset value is less that previous read "imfile in rsyslog"

Next, below is message is only partially sent (contents after read) "rsyslog uses imfile to read arbitrary file"

Can someone suggest a solution by which i can have rsyslog read the file fully whenever there is change in timestamp of the file.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.