Issue

What were you trying to do that didn't work? rsyslog is configured to collect messages from the log files managed by external application, and after the application removes old file, rsyslog imfile doesn't release it. What is the impact of this issue to you? Disk space is not freed until the rsyslog service gets restarted Please provide the package NVR for which the bug is seen: rsyslog-8.2506.0-2.el9.x86_64 How reproducible is this bug? configure rsyslog to monitor some log file using imfile module, remove the log file Steps to reproduce [root@fastvm-rhel-9-6-196 ~]# rpm -q rsyslog rsyslog-8.2506.0-2.el9.x86_64 [root@fastvm-rhel-9-6-196 ~]# cat /etc/rsyslog.d/99-imfile.conf module(load="imfile" PollingInterval="10") input(type="imfile" File="/var/log/imfile-test*.log" Tag="var-log-imfile-test" Severity="info" Facility="local7" addMetadata="on" ignoreOlderThan="60" ) [root@fastvm-rhel-9-6-196 ~]# for i in {1..10}; do echo $(date) >> /var/log/imfile-test-01.log; done [root@fastvm-rhel-9-6-196 ~]# systemctl restart rsyslog [root@fastvm-rhel-9-6-196 ~]# lsof | grep imfile-test ... rsyslogd 74591 74594 in:imfile root 10r REG 253,0 320 1311 /var/log/imfile-test-01.log rsyslogd 74591 74594 in:imfile root 11r REG 253,0 320 1311 /var/log/imfile-test-01.log rsyslogd 74591 74595 rs:main root 10r REG 253,0 320 1311 /var/log/imfile-test-01.log rsyslogd 74591 74595 rs:main root 11r REG 253,0 320 1311 /var/log/imfile-test-01.log [root@fastvm-rhel-9-6-196 ~]# rm /var/log/imfile-test-01.log rm: remove regular file '/var/log/imfile-test-01.log'? y [root@fastvm-rhel-9-6-196 ~]# lsof | grep imfile-test ... rsyslogd 74591 74594 in:imfile root 10r REG 253,0 320 1311 /var/log/imfile-test-01.log (deleted) rsyslogd 74591 74594 in:imfile root 11r REG 253,0 320 1311 /var/log/imfile-test-01.log (deleted) rsyslogd 74591 74595 rs:main root 10r REG 253,0 320 1311 /var/log/imfile-test-01.log (deleted) rsyslogd 74591 74595 rs:main root 11r REG 253,0 320 1311 /var/log/imfile-test-01.log (deleted) Expected results rsyslog imfile releases deleted log file in reasonable time Actual results rsyslog imfile never releases deleted log file (at least it doesn't for >2 hours)

Release Notes

No. of Comments

Resolution

Not a Bug