Rsyslog: imfile module readTimeout does not time out (8.25.0)

[feature-id]

Same problem as in this closed issue.

rsyslog 8.25.0

Steps to reproduce:

1. Originally, we have rsyslog with imfile section. Messages delivery is working fine.
2. Restart rsyslog service (centos 7 here, so systemctl restart rsyslog).
3. readTimeout stops working (means, if we send a new message to the log, it isn't processed, until we send another one. and we get just 1st message on the output, 2nd is still inside, until we send a 3rd message and so on).
4. Fix that works for me: stop rsyslog, delete imfile state file for my source logfile and start again.

A bug or any idea what can be wrong?

My imfile section:

input(
    type="imfile"
    File="/var/log/elasticsearch/elastic*.log"
    Tag="aaa_elastic"
    Severity="notice"
    Facility="local6"
    readTimeout="2"
    startmsg.regex="^.[[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2}"
    escapeLF="off")

Same problems without wildcard.
Works fine without startmsg.regex, but that makes multilined logs processed wrong.

[tedg]

Wanted to say that I am having this same issue on 8.26.0

My configuration is similar to the one posted above, so I'm not going to post it.

    rsyslogd 8.26.0, compiled with:
    PLATFORM:                               x86_64-redhat-linux-gnu
    PLATFORM (lsb_release -d):
    FEATURE_REGEXP:                         Yes
    GSSAPI Kerberos 5 support:              No
    FEATURE_DEBUG (debug build, slow code): No
    32bit Atomic operations supported:      Yes
    64bit Atomic operations supported:      Yes
    memory allocator:                       system default
    Runtime Instrumentation (slow code):    No
    uuid support:                           Yes
    Number of Bits in RainerScript integers: 64

[jhenry82]

Confirming the same behavior in 8.26.0.

[jhenry82]

Actually, I need to revise that statement. How are you folks loading the imfile module? With "$ModLoad imfile" or "module(load="imfile")" ?

I found that once I switched to the module() style syntax, readTimeout works as expected. It seems that ModLoad creates a version of imfile that does not support all new features, like readTimeout and inotify mode.

[feature-id]

I'm using module(load="imfile") syntax.

[jhenry82]

Ok. Weird, it's working for me now that I made that change.

[tedg]

Also using module(load="imfile") syntax

[alorbach]

Can somebody post a full debug log where it happens?

[rgerhards]

I have just re-confirmed that the testbench has timeout-related tests and they always pass. So this must be somehow induced by the environment. In other words, we currently have no idea of how to reproduce and really need a debug log to proceed any further.

[rgerhards]

Tentatively assigning milestone in the hope that we get more information. If not, I'll (re)move milestone again.

[rgerhards]

FYI: I got a debug log via private mail and it looks very promising.

[lock[bot]]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.