0

I am using Ubuntu 14.04 and I have managed to use rsyslog to push my Apache error logs to Papertrail. I then moved onto monitor another log file and after a restart and commenting out the Apache config lines, I still get Apache logs being monitored!

Does rsyslog cache config files somewhere? I have restated rsyslog via sudo service rsyslog restart and /etc/init.d/rsyslog restart.

Here is my current config file that seems to be monitoring my Apache error.log file even though it is commented out.

$ModLoad imfile
$InputFilePollInterval 10

# Apache Error file: 
#$InputFileName /var/log/apache2/error.log
#$InputFileTag apache-error:
#$InputFileStateFile stat-apache-error
#$InputFileSeverity error
#$InputRunFileMonitor

# App Error files:
$InputFileName /var/www/html/application/logs/log.php
$InputFileTag apache-error:
$InputFileStateFile stat-apache-error
$InputFileSeverity error
$InputRunFileMonitor

When I comment out this whole file, the Apache errors stop being monitored. What can I try next?

halfer
  • 19,824
  • 17
  • 99
  • 186
Abs
  • 56,052
  • 101
  • 275
  • 409

1 Answers1

0

I can't explain the symptom you described, but did notice another problem which may be related. The InputFileStateFile configuration flag is a filename where rsyslog keeps its current position in the target file (InputFileName). The state file (stat-apache-error) is not deleted when rsyslog stops, so rsyslog knows where to start sending.

Using the same state file for 2 different underlying files will probably make rsyslog start at the wrong place, since the offset from /var/log/apache2/error.log won't be correct for /var/www/html/application/logs/log.php. Either use a different state file or remove the stat-apache-error file when you enable the second config.

Troy Davis
  • 487
  • 5
  • 8