Impact of Stopping rsyslog and Behavior of imfile-state Files

Products

• VMware vCenter Server

Issue/Introduction

Questions regarding the impact of stopping the rsyslog service and behavior related to imfile-state files.

Environment

VMware vCenter Server

Resolution

When restarting rsyslogd, the behavior depends on the presence of the imfile-state file:

• If the imfile-state file exists, rsyslog checks the recorded offset to determine where it last read, and resumes forwarding logs from that point onward.

• If the imfile-state file does not exist, rsyslog treats the target file as new. By default (freshStartTail=off), it starts reading from the beginning. If freshStartTail=on, it instead starts from the end of the file.

Reference:
/storage/log filling up with imfile-state files | rsyslogd

Since the provided workaround script deletes imfile-state files, the latter behavior is expected. As a result, compared to continuous log forwarding, there may be a temporary increase in log volume.

 

Related Questions

Q1: What is the impact if file creation and deletion occur at the same time?

A: If the imfile-state file is absent, rsyslog treats the target log file as new. Depending on freshStartTail, it will start from the beginning (default) or from the end.  
Therefore, even if a file is created and deleted at the same time (e.g., by cron), it is simply recognized as a new file. However, unread log lines may be lost, or past logs may be resent, depending on timing.

 

Q2: How should this be handled in a vCenter HA environment?

A: In a vCenter HA deployment (Active/Passive/Witness nodes), cron settings must be configured on each node individually.
They are not automatically propagated from the active node to the others. Therefore, please configure cron on each node, including after a failover event.