Here is my intended scenario that partially works now.  I am using this UnRaid as my main syslog repository with syslog server configured to store logs into a dedicated share named LOGS. Fort that I configured a share LOGS with "primary storage" to cache and "secondary storage" to array and 'mover action" cache -->array scheduled weekly. 

 

My expected behavior will be that syslog will constantly write to cache and not array therefore my array & parity drives won't be spinning all the time, except when the mover schedule take place every week.  But that is not the case.  I have about 10 devices sending logs to this UnRaid and some of them are written to cache and some of them to the array, they're are very inconsistent and some of my array and parity drives are constantly spinning.

 

Am I doing something wrong or this is the expected behavior?  Any advise or guidance please

 

 

Edited September 25, 20232 yr by DivideBy0

Anybody?

23 hours ago, DivideBy0 said:

 

or this is the expected behavior?

 

Yes.

The mover doesnt move files that are activly being used. if a file has been moved to the array, it will stay on the array if its being modified.

If you wanna solve this you would need to set the "syslog"-share to only live on the cache drive and run a script which copies the logs in the time intervals youre looking for to the array.

Or write a script to daily:

• Stop syslog
• Execute Mover
• Start Syslog

 

that would work too. But that would require every participant to create a new file instead of just continuing to write into the existing ones. By what you said, the mover did manage to move some files to the array but .15 kept writing to the array file instead of creating a new syslog.

Edited September 26, 20232 yr by Mainfrezzer

I could play with the syslog file size? Now is set to 5Megs. Maybe if I drop it to 1 or 2 Megs will work better? Thinking if I limit the size then syslog will start writing new files on cache and when the movers kick in it will just move the completed ones.

 

Well I ended up with a custom script that does it all for me daily.

 

#!/bin/bash
sh /etc/rc.d/rc.rsyslogd stop
for file in /mnt/cache/NVME-LOGS/*; do
    mv "$file" "/mnt/disk7/LOGS/$(date +"%Y%m%d_%H%M%S")_$(basename "$file")"
done
sh /etc/rc.d/rc.rsyslogd start

Edited October 3, 20232 yr by DivideBy0