Werk #15307: logwatch_ec: tcp remote forwarding: create one spool file per service
| Component | Checks & agents | ||||||||
| Title | logwatch_ec: tcp remote forwarding: create one spool file per service | ||||||||
| Date | Nov 13, 2023 | ||||||||
| Level | Trivial Change | ||||||||
| Class | Bug Fix | ||||||||
| Compatibility | Compatible - no manual interaction needed | ||||||||
| Checkmk versions & editions |
|
This Werk affects you if you have a logwatch_ec check which forwards events to a remote syslog hosts and if you activated the option "Create a separate check for each logfile".
In this case all separate services shared one spoolfile. This lead to the problem, that one event in the spoolfile was displayed as one event for each separate service (but it was only sent out once, when the remote was reachable again).
In some conditions events might been unnoticeable dropped, because the spoolfile was overwritten by another logwatch service.
Now each logwatch service will have their own spoolfile.
The spoolfiles will be automatically assigned to their logwatch service.
After all your logwatch_ec services sent all their spoolfiles out, you may manually consult the following folder for spoolfile.* files:
./var/check_mk/logwatch_spool/<hostname>
If there are any spoolfiles in this folder, they could not be assigned to a logwatch service. If you still want them to be forwarded, move them to one of the folders, otherwise they can be deleted.
./var/check_mk/logwatch_spool/<hostname>/item_<url_encode(item)>