rsyslogd is acting strangely and I don't know why. Sometimes it writes messages to the relevant log files immediately; sometimes it treasures them up in a buffer somewhere and writes them some time later.
At first I assumed this had something to do with "file syncing", i.e. with the $ActionFileEnableSync option in the global rsyslog config file, or with leading hyphens on individual logfile specifiers. But changing those options doesn't seem to have any effect, and I'm starting to doubt that's the issue, anyway.
What I mean by "sometimes it writes immediately" is that it literally cycles into and out of this mode, with a period which is on the order of minutes. For example, just now, with a loop like
while sleep 1; do logger hello world
date
; done
running to keep the log messages flowing, I observe that for 30 seconds the messages show up in /var/log/messages immediately, then for 134 seconds no messages appear, then all the missing messages show up at once and for 30 more seconds messages appear in real time, followed by another 134-second blackout, etc.
Last week, when I first started investigating this, I sometimes observed that the periods of real-time logging lasted for 60 seconds, not 30. I haven't tried to determine whether the timing is in any way based on the volume of data logged, although that's an obvious question.
As I said, at first I assumed that setting $ActionFileEnableSync would help, but (a) it didn't, and (b) [the documentation](https://www.rsyslog.com/doc/configuration/modules/omfile.html) says that this option is dangerous and a performance killer and shouldn't be used unless you really know what you're doing, and (c) I can't imagine that the cycling I'm seeing, between instantaneous versus buffered logging, is normal or expected or desirable anyway, in any mode.
This is happening under Ubuntu 22.04.1, rsyslogd version 8.2112.0. Also, it's an AWS abstract machine instance, which I suppose might have something to do with this.
And, anyway, my question is, how can I make this stop? I need real-time or near real-time logging; I can't wait for a couple of minutes to see whether a log message appeared or not.
Asked by Steve Summit
(918 rep)
May 29, 2025, 11:38 PM
Last activity: May 31, 2025, 11:57 AM
Last activity: May 31, 2025, 11:57 AM