rsyslog - imfile-state configuration meanings

Question

In a rsyslog directory for a service I am working with, there are a number of imfile-state files (for example, imfile-state:163613:604cabbcd415ea81 ). As far as I am aware, Rsyslog must keep track of which parts of the monitored file are already processed. This is done in so-called "state files". In these files, the following info can be found:

{ "filename": "\/path\/to\/file.log", "prev_was_nl": 0, "curr_offs": 17929530, "strt_offs": 17929530 }

I am unsure on what the following mean:

• prev_was_nl
• curr_offs
• strt_offs

I can't seem to find anything about them online - can anyone shed some light for me?

Answer 1

You are correct, to keep track of which parts of the monitored file are already processed, rsyslog uses the so-called “state files” that are created in the rsyslog working directory - global(workDirectory) - and are read on startup to resume monitoring after a shutdown.

According to the rsyslog documentation , there is intentionally no more precise description of the state file naming , as this is an implementation detail and may change as needed.

Looking into the source code of the imfile module, doesn't give much more information either.

So to now answer the question; I don't know . If you really want to know, you will probably have to ask a developer.