{"action":"created","issue":{"url":"https://api.github.com/repos/rsyslog/rsyslog/issues/301","labels_url":"https://api.github.com/repos/rsyslog/rsyslog/issues/301/labels{/name}","comments_url":"https://api.github.com/repos/rsyslog/rsyslog/issues/301/comments","events_url":"https://api.github.com/repos/rsyslog/rsyslog/issues/301/events","html_url":"https://github.com/rsyslog/rsyslog/issues/301","id":67929285,"number":301,"title":"rsyslogd regurgitates old syslog messages at random times","user":{"login":"nickandrew","id":7175,"avatar_url":"https://avatars.githubusercontent.com/u/7175?v=3","gravatar_id":"","url":"https://api.github.com/users/nickandrew","html_url":"https://github.com/nickandrew","followers_url":"https://api.github.com/users/nickandrew/followers","following_url":"https://api.github.com/users/nickandrew/following{/other_user}","gists_url":"https://api.github.com/users/nickandrew/gists{/gist_id}","starred_url":"https://api.github.com/users/nickandrew/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nickandrew/subscriptions","organizations_url":"https://api.github.com/users/nickandrew/orgs","repos_url":"https://api.github.com/users/nickandrew/repos","events_url":"https://api.github.com/users/nickandrew/events{/privacy}","received_events_url":"https://api.github.com/users/nickandrew/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-04-12T15:54:13Z","updated_at":"2015-09-06T10:12:18Z","closed_at":null,"body":"I'm running rsyslog 7.4.4-1ubuntu2.3 under an lxc container (this may be relevant).\r\n\r\nSometimes messages logged to rsyslog don't appear in syslog output for days.\r\n\r\nExample: A check-net shell script runs every minute (it uses /usr/bin/logger to log its messages). Running this simple script:\r\n\r\n```\r\nwhile true ; do logger \"hello $(date)\" ; sleep 1 ; done\r\n```\r\n\r\nI see the regular every-second output logged in /var/log/syslog as well as older messages from check-net which, I think, were not logged at the time. It is as if rsyslogd is receiving the log packet and holding it (for duplicate detection?) and not releasing it for a very very long time. The output was:\r\n\r\n```\r\nApr 13 01:45:25 gateway5 root: hello Mon Apr 13 01:45:25 AEST 2015\r\nApr 13 01:45:26 gateway5 root: hello Mon Apr 13 01:45:26 AEST 2015\r\nApr 13 01:45:27 gateway5 root: hello Mon Apr 13 01:45:27 AEST 2015\r\nApr  8 09:21:00 gateway5 check-net[1415]: Intermediate state: prefer=iinet, defaultroute=iinet  Keep\r\nApr 13 01:45:28 gateway5 root: hello Mon Apr 13 01:45:28 AEST 2015\r\nApr  2 04:51:01 gateway5 check-net[1415]: Intermediate state: prefer=iinet, defaultroute=iinet  Keep\r\nApr 13 01:45:29 gateway5 root: hello Mon Apr 13 01:45:29 AEST 2015\r\nApr 13 01:45:30 gateway5 root: hello Mon Apr 13 01:45:30 AEST 2015\r\nApr 13 01:45:31 gateway5 root: hello Mon Apr 13 01:45:31 AEST 2015\r\nApr 13 01:45:32 gateway5 root: hello Mon Apr 13 01:45:32 AEST 2015\r\n```\r\n\r\nAs you can see, the check-net messages appearing were held around 5 and 11 days respectively.\r\n\r\nIt's not just check-net, syslog from CRON and other logging sources may be similarly delayed."},"comment":{"url":"https://api.github.com/repos/rsyslog/rsyslog/issues/comments/138062218","html_url":"https://github.com/rsyslog/rsyslog/issues/301#issuecomment-138062218","issue_url":"https://api.github.com/repos/rsyslog/rsyslog/issues/301","id":138062218,"user":{"login":"toolforger","id":915906,"avatar_url":"https://avatars.githubusercontent.com/u/915906?v=3","gravatar_id":"","url":"https://api.github.com/users/toolforger","html_url":"https://github.com/toolforger","followers_url":"https://api.github.com/users/toolforger/followers","following_url":"https://api.github.com/users/toolforger/following{/other_user}","gists_url":"https://api.github.com/users/toolforger/gists{/gist_id}","starred_url":"https://api.github.com/users/toolforger/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/toolforger/subscriptions","organizations_url":"https://api.github.com/users/toolforger/orgs","repos_url":"https://api.github.com/users/toolforger/repos","events_url":"https://api.github.com/users/toolforger/events{/privacy}","received_events_url":"https://api.github.com/users/toolforger/received_events","type":"User","site_admin":false},"created_at":"2015-09-06T10:12:18Z","updated_at":"2015-09-06T10:12:18Z","body":"This might be the same as http://bugzilla.adiscon.com/show_bug.cgi?id=527 , which also proposes a fix."}}