search

ankiit / logstash

Automatically exported from code.google.com/p/logstash
0 stars 0 forks source link

logstashed died after mass file rotation? #39

Open GoogleCodeExporter opened 9 years ago

GoogleCodeExporter commented 9 years ago 
Hi,

it looks like logstash had a fit after a mass rotation (attached)

should i try a newer version of something in the crashlog?

Original issue reported on code.google.com by charlie....@gmail.com on 15 Feb 2011 at 10:51

Attachments:

GoogleCodeExporter commented 9 years ago 
happened again on a different debian box:

W, [2011-02-19T06:25:01.440460 #3654]  WARN -- : notify: unbind on 
/var/log/messages
W, [2011-02-19T06:25:01.440680 #3654]  WARN -- : notify: unbind on 
/var/log/syslog
W, [2011-02-19T06:25:01.440907 #3654]  WARN -- : notify: unbind on 
/var/log/dmesg
W, [2011-02-19T06:25:01.441121 #3654]  WARN -- : notify: unbind on 
/var/log/auth.log
W, [2011-02-19T06:25:01.441353 #3654]  WARN -- : notify: unbind on 
/var/log/kern.log
W, [2011-02-19T06:25:01.441573 #3654]  WARN -- : notify: unbind on 
/var/log/lpr.log
W, [2011-02-19T06:25:01.441772 #3654]  WARN -- : notify: unbind on 
/var/log/user.log
W, [2011-02-19T06:25:01.441977 #3654]  WARN -- : notify: unbind on 
/var/log/mail.log
W, [2011-02-19T06:25:01.442142 #3654]  WARN -- : notify: unbind on 
/var/log/dpkg.log
W, [2011-02-19T06:25:01.442358 #3654]  WARN -- : notify: unbind on 
/var/log/daemon.log
/var/lib/gems/1.8/gems/eventmachine-tail-0.5.20110118081348/lib/em/filetail.rb:1
84:in `initialize': No such file or directory - /var/log/syslog (Errno::ENOENT)
        from /var/lib/gems/1.8/gems/eventmachine-tail-0.5.20110118081348/lib/em/filetail.rb:184:in `open'
        from /var/lib/gems/1.8/gems/eventmachine-tail-0.5.20110118081348/lib/em/filetail.rb:184:in `open'
        from /var/lib/gems/1.8/gems/eventmachine-tail-0.5.20110118081348/lib/em/filetail.rb:287:in `schedule_reopen'
        from /var/lib/gems/1.8/gems/eventmachine-0.12.10/lib/eventmachine.rb:996:in `call'
        from /var/lib/gems/1.8/gems/eventmachine-0.12.10/lib/eventmachine.rb:996:in `run_deferred_callbacks'
        from /var/lib/gems/1.8/gems/eventmachine-0.12.10/lib/eventmachine.rb:996:in `each'
        from /var/lib/gems/1.8/gems/eventmachine-0.12.10/lib/eventmachine.rb:996:in `run_deferred_callbacks'
        from /var/lib/gems/1.8/gems/eventmachine-0.12.10/lib/eventmachine.rb:256:in `run_machine'
        from /var/lib/gems/1.8/gems/eventmachine-0.12.10/lib/eventmachine.rb:256:in `run'
        from /var/lib/gems/1.8/gems/logstash-0.2.20110206003556/lib/logstash/agent.rb:95:in `run'
        from /var/lib/gems/1.8/gems/logstash-0.2.20110206003556/bin/logstash:86
        from /var/lib/gems/1.8/bin/logstash:19:in `load'
        from /var/lib/gems/1.8/bin/logstash:19
[1]  + exit 1     sudo /var/lib/gems/1.8/bin/logstash -f logstash.yaml
12:11 charlievmware:~# 
15:33 charlievmware:~# fg
fg: no current job
15:33 charlievmware:~# cat logstash.yaml
inputs:
  syslog: # each input must have a type, the type can be anything.
  - /var/log/messages
  - /var/log/syslog
  - /var/log/dmesg
  msp-server:
  - /var/log/msp/msp-server.log
  # Wildcards work.
  - /var/log/*.log
  apache-access:
  - /var/log/apache2/access.log
  apache-error:
  - /var/log/apache2/error.log

outputs:
- stdout:///   # output events to stdout for debugging, remove if you don't want
- amqp://94.228.70.7/fanout/rawlogs   # ship logs to the 'rawlogs' fanout queue.

15:35 charlievmware:~#

Original comment by charlie....@gmail.com on 20 Feb 2011 at 3:35