0

I've configured rsyslog to forward certain log messages to a named pipe /tmp/logger.pipe. I then have a separate process reading from the named pipe. Relevant section from /etc/rsyslog.conf

# Remote Logging (silly conditional rule needed for specific logging scenario)
$template RFC5424Format,"<%PRI%>1 %timegenerated:1:10:date-rfc3339%T%timegenerated:12:19:date-rfc3339%.%timegenerated:21:26:date-rfc3339%Z %HOSTNAME% - - -%msg%\n"
if ($msg contains 'remote="true"') then /tmp/logger.pipe;RFC5424Format

Permissions on /tmp/logger.pipe

prwxrwxrwx 1 ftp root 

I'm deploying this application onto two different machines. One machine features rsyslog v3.x.x and the other v5.x.x

enter image description here

enter image description here

The application is working wonderfully on the machine with rsyslog v5.x.x. However, I'm experiencing odd behavior on the machine with rsyslog v3.x.x. Specifically:

  1. rsyslogd sometimes takes forever to start on initial boot up (it was very snappy prior to me adding the new rule).
  2. When the process reading logger.pipe restarts, rsyslogd seems to stop writing data to the named pipe after the listening process has resumed. The only way to fix this is to manually issue a restart to rsyslogd

Is there some trick with rsyslog configuration that I'm missing when working with named pipes? Any other permissions issues I may be overlooking? I am confident in the application since it's been working very robustly with the v5.x.x rsyslog version. Unfortunately I have no way to update the v3.x.x version on the machine I'm having issues with.

Any thoughts?

Update: I may have diagnosed the problem - it appears to be an issue where rsyslogd closes the write connection to the pipe if there are no readers. However, the reader application uses fopen() which blocks until there is a corresponding writer.

For some reason this is not an issue on rsyslog v5.x.x:

  1. initial state where rsyslogd and logger.out successfully have pipe open

enter image description here

  1. issue restart on _logger.out, rsyslogd still have write open to pipe

enter image description here

  1. _logger.out resumes and everything functions correctly again

But this behavior is different on rsyslog v3.x.x:

  1. initial state where rsyslogd and logger.out successfully have pipe open

enter image description here

  1. issue restart on _logger.out, rsyslogd for some reason closes connection to pipe

enter image description here

1 Answer 1

0

From rsyslog document, it looks like the target should include a pipe symbol. This modification resolved my problem such that rsyslog would maintain an open connection to the named pipe even when the reader closed.

I can't explain why this was only an issue on rsyslog v3.x.x however.

enter image description here

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .