I recently ran into a problem and was hoping someone could help me figure it out. I am running Ubuntu 10.04 and rsyslog 5.8.1. I setup rsyslog to monitor a few files and send the any changes to those files to Loggly (great service by the way). Well, it all works great, except for the fact that whenever I restart rsyslog it resends everything from those files that it had sent in the past. Now, it is my understanding that rsyslog should use the $WorkDirectory and create what file that you set for $InputFileStateFile to save the state of the monitored file so that it does not send duplicate entries.
Here is an example that I'm working with:
# Monit log file
So, from my description above, rsyslog should create a "monit-state" file in "/var/log/rsyslog" which would save the state of the /var/log/monit.log" file so no duplicates are sent. Is that correct? If so, this is not happening!
What should the premission of "/var/log/rsyslog" be? Do I have to touch "monit-state" in "/var/log/rsyslog" (I tried that already and nothing happened)?
I've been working on this for a couple days and am at a loss, so any help would be appreciated. Thanks.