TCP is 'lossless' in that the OS will resend any packets that get dropped by the network during a connection, but when the connection fails for any reason, the sending application has no way to know if the data it's sent to the OS has been received by the system on the far side or not.
If you need this level of reliability, you need to use the relp transport (Reliable Event Logging Protocol), it includes application level acknoledgements so that the sending rsyslog knows that the receiving rsyslog really did get the message.
Even with this, you can loose messages if the systems crash, because rsyslog queues messages in memory. You can configure rsyslog to save everything to disk for complete reliability, but since even fast disks are incredibly slow compared to memory, your performance will drop by a factor of around 1000x, so it's probably not something that you want to do unless you have some incredibly important logs.
David Lang On Thu, 23 May 2013, Robert Navarro wrote:
Hey David, I don't have any firewalls set that I know of, I've reached out to my provider to confirm. The server in question is running Ubuntu 12.04.2 LTS root@cron2# rsyslogd -v rsyslogd 5.8.6, compiled with: FEATURE_REGEXP: Yes FEATURE_LARGEFILE: No GSSAPI Kerberos 5 support: Yes FEATURE_DEBUG (debug build, slow code): No 32bit Atomic operations supported: Yes 64bit Atomic operations supported: Yes Runtime Instrumentation (slow code): No I've also attached a copy of the servers' kernel system variables...I didn't see anything that stood out to me...but maybe I'm missing something. Let me know if you need any additional debug information. On Wed, May 22, 2013 at 9:55 PM, David Lang <[email protected]> wrote:what version of rsyslog is this? I don't remember seeing anything like this before. Rainer is out (presenting at Linuxtag I believe) this week TCP should only be able to drop messages when the connection is cut. Do you have a firewall in between your source and destination that may have some sort of timeout or other limit? David Lang On Wed, 22 May 2013, Robert Navarro wrote: Date: Wed, 22 May 2013 17:38:49 -0700From: Robert Navarro <[email protected]> Reply-To: rsyslog-users <[email protected]> To: [email protected] Subject: [rsyslog] Dropped Log Debug Hello, I'm trying to debug some log dropping issues and I notice lines like this in the debug output: 3119.633279579:7ff32b5d5700: TCP sent 16384 bytes, requested 25903 3119.633300017:7ff32b5d5700: message not completely (tcp)send, ignoring 16384 3119.669879126:7ff32b5d5700: TCP sent 16384 bytes, requested 63433 3119.669908446:7ff32b5d5700: message not completely (tcp)send, ignoring 16384 3121.689679357:7ff32b5d5700: TCP sent 16384 bytes, requested 105302 3121.689780045:7ff32b5d5700: message not completely (tcp)send, ignoring 16384 is that cause for concern? What other things should I be looking at to help debug this? The output above was generated using the following command: rsyslogd -c5 -dn > log.txt ______________________________**_________________rsyslog mailing list http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
sysctl.log
Description: Binary data
_______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
