The bug was introduced by the changes for the multilevel wildcard feature
which has been added recently. We have to handle FileCreate events different
if the directory watch is configured or added dynamically.
closes https://github.com/rsyslog/rsyslog/issues/1452
testsuite: Also added msleep between directory and file creation
in imfile wildcard tests. Sometimes a directory watch was not created
before the testsuite created a logfile.
When $WorkDirectory was not configured in rsyslog configuration, invalid
path/filenames were generated for statefiles causing failure on
deleting statefiles and more.
imfile supports now wildcards on multiple levels.
Directories can be dynamically added and removed.
Each directory has its own inotify watch.
Initial coding is done, no propper tests have to be added.
when deploy rsyslog to a large number of servers. We may only care about new logs after the deployment. In this case, logs generated before should be discarded, otherwise, there may be vast useless message burst on the central rsyslog receiver.
set **FreshStartTail** to *on* cause imfile to seek to the end/taill of input file at fresh start, which means only new log events will be processed.
If a to-be-monitored file was created after inotify was initialized
but before startup was completed, the first chunk of data from this
file could be duplicated. This should have happened very rarely in
practice, but caused occasional testbench failures.
closes https://github.com/rsyslog/rsyslog/issues/791
`evFileHelper.name` is not allocated and not used at all, in typical
case its address is the same as the local variable `etry` in the same
stack (compiler optimization), assigning to `evFileHelper.name[0]`
actually corrupts the etry data structure and crashes the program.
Here's an example output from gdb session.
```
(gdb) p &evFileHelper.name
$6 = (char (*)[]) 0x7ffff6dfc930
(gdb) p &etry
$7 = (wd_map_t **) 0x7ffff6dfc930
(gdb)
```
Remove the use sizeof(char) or sizeof(uchar) in calculations for memory
allocation or string length. There are no known platforms for which
sizeof(char) or sizeof(uchar) is not 1, and c99 has defined sizeof(char)
to be 1 (section 6.5.3.4 of c99).
