> -----Original Message----- > From: [email protected] > [mailto:[email protected]] On Behalf Of Fajun Chen > Sent: 08 May 2013 03:56 > To: [email protected] > Subject: [rsyslog] Rsyslog Disk Queue Flush Issue > > > Hi, > > I use disk-assisted queue to buffer logs when remote logging host is > unavailable or network is down. The problem I ran into is > when the disk > queue hits the maximal disk space limit, it stops accepting > incoming logging > entries as expected, but it doesn't flush existing queued > entries when the > remote host is back to normal. If the remote host is set > before maximal disk > space limit is reached, it works without issues. I tested on > rsyslog 5.8.6, > 5.8.13 and 7.3.13, neither seems to be working. > > My rsyslog configuration on sending end: > # start forwarding rule 1 of 1 > $ActionQueueType LinkedList > $ActionQueueFileName srvrfwd > $ActionResumeRetryCount -1 > $ActionQueueSaveOnShutdown on > $ActionQueueMaxDiskSpace 100000000 > $ActionQueueSize 200000 # Tried 100000 as well > $ActionQueueHighWaterMark 600 > $ActionQueueLowWaterMark 200 > $ActionQueueTimeoutEnqueue 1 > > #local5.* :omrelp:127.255.255.1:20514 # Invalid IP to trigger log > buffering > local5.* :omrelp:172.17.5.28:20514 # Real IP to trigger log > forwarding > # end forwarding rule 1 of 1 > > Has anyone seen similar issues? > > Thanks, > Fajun
I've seen a similar issue with the 5.8.x versions. 7.2.5 has not had this problem. I'm using the rpms from the adison repo and running centos 5.9. When I have been testing this, I shutdown the rsyslog receiver to force the client to start queueing logs. When I start the syslog receiver, the client will start sending logs. If I have the client machine under considerable load, it doesn't send the queued logs immediately but will eventually. (I create log volume with "find / -print | logger" for example). Here's my config: ===== # statistics $ModLoad impstats.so $PStatInterval 60 $ModLoad imudp $UDPServerAddress 127.0.0.1 $UDPServerRun 514 # RELP support $ModLoad omrelp # in the case of logging to localhost, ensure hostname is the correct hostname. $Template ForceHostnameFormat,"<%PRI%>%TIMESTAMP:::date-rfc3339% %$myhostname% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%" $ActionFileDefaultTemplate ForceHostnameFormat $MaxMessageSize 65536 $RepeatedMsgReduction off $WorkDirectory /data/logs/rsyslog/work # default location for work (spool) files #$MainMsgQueueFileName mainq # set file name, also enables disk mode #$MainMsgQueueMaxFileSize 100m $ActionQueueType LinkedList # use asynchronous processing $ActionQueueSize 100000 $ActionQueueFileName srvrfwd # set file name, also enables disk mode $ActionResumeRetryCount -1 # infinite retries on insert failure $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down $ActionQueueTimeoutEnqueue 10 $ActionResumeInterval 5 $ActionQueueDiscardSeverity 4 $ActionQueueCheckpointInterval 10000 $ActionQueueDequeueBatchSize 50000 $ActionQueueWorkerThreads 10 $ActionQueueMaxFileSize 100m $ActionQueueMaxDiskSpace 1g ## send to rsyslogd on dp cluster using relp. *.* :omrelp:syslog-relp:20514;ForceHostnameFormat ==== Alan Edmonds NOTICE AND DISCLAIMER This email (including attachments) is confidential. If you are not the intended recipient, notify the sender immediately, delete this email from your system and do not disclose or use for any purpose. Deutsche Telekom (UK) Limited Company Registered Number: 3951860 Registered Office Address: Hatfield Business Park, Hatfield, Hertfordshire, AL10 9BW Registered in England and Wales _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
