在我的配置中,我有rsyslog负责使用imfile跟踪/home/user/my_app/shared/log/unicorn.stderr.log的更改.使用TCP将内容发送到另一个远程日志记录服务器.
当日志文件旋转时,rsyslog会停止向远程服务器发送数据.
我尝试重新加载rsyslog,发送HUP信号并完全重新启动它,但没有任何效果.
我发现实际工作的唯一方法是脏的：
>停止服务,删除rsyslog stat文件并再次启动rsyslog.所有这些都在我的logrotate文件中的postrotate钩子中.
> kill -9 rsyslog并重新启动它.
如果没有触及rsyslog内部,我有没有正确的方法呢？
Rsyslog文件
$ModLoad immark $ModLoad imudp $ModLoad imtcp $ModLoad imuxsock $ModLoad imklog $ModLoad imfile $template WithoutTimeFormat,"[environment] [%syslogtag%] -- %msg%" $WorkDirectory /var/spool/rsyslog $InputFileName /home/user/my_app/shared/log/unicorn.stderr.log $InputFileTag unicorn-stderr $InputFileStateFile stat-unicorn-stderr $InputFileSeverity info $InputFileFacility local8 $InputFilePollInterval 1 $InputFilePersistStateInterval 1 $InputRunFileMonitor # Forward to remote server if $syslogtag contains 'apache-' then @@my_server:5000;WithoutTimeFormat :syslogtag,contains,"apache-" ~ *.* @@my_server:5000;SyslFormat
Logrotate文件
/home/user/my_app/shared/log/*.log {
daily
missingok
dateext
rotate 30
compress
notifempty
extension gz
copytruncate
create 640 user user
sharedscripts
post-rotate
(stop rsyslog && rm /var/spool/rsyslog/stat-* && start rsyslog 2>&1) || true
endscript
}
仅供参考,该文件对于rsyslog用户是可读的,我的服务器是可访问的,并且在同一周期内不旋转的其他日志文件继续被正确跟踪.
我正在运行Ubuntu 12.04.
解决方法
问题实际上来自logrotate.
基本上我的配置,运行独角兽,我不需要使用copytruncate指令. (这是导致问题的原因)
USR1 – Reopen all logs owned by the worker process. See
Unicorn::Util.reopen_logs for what is considered a log. Log files are
not reopened until it is done processing the current request,so
multiple log lines for one request (as done by Rails) will not be
split across multiple logs.
更新到此配置后,这开始正常工作：
/home/user/my_app/shared/log/*.log {
daily
missingok
dateext
rotate 30
compress
notifempty
extension gz
create 640 user user
sharedscripts
post-rotate
# Telling Unicorn to reload files
test -s /home/user/my_app/shared/pids/unicorn.pid && kill -USR1 "$(cat /home/user/my_app/shared/pids/unicorn.pid)"
# Reloading rsyslog telling it that files have been rotated
reload rsyslog 2>&1 || true
endscript
}
