It's entirely possible that something is being NATT'd somewhere....my cloud provider is Rackspace..I'll pose the question to them.
On Thu, May 23, 2013 at 9:23 AM, David Lang <[email protected]> wrote: > Is this running through a NAT device anywhere? that could also cut the TCP > connection. > > TCP is 'lossless' in that the OS will resend any packets that get dropped > by the network during a connection, but when the connection fails for any > reason, the sending application has no way to know if the data it's sent to > the OS has been received by the system on the far side or not. > > If you need this level of reliability, you need to use the relp transport > (Reliable Event Logging Protocol), it includes application level > acknoledgements so that the sending rsyslog knows that the receiving > rsyslog really did get the message. > > Even with this, you can loose messages if the systems crash, because > rsyslog queues messages in memory. You can configure rsyslog to save > everything to disk for complete reliability, but since even fast disks are > incredibly slow compared to memory, your performance will drop by a factor > of around 1000x, so it's probably not something that you want to do unless > you have some incredibly important logs. > > David Lang > > > > On Thu, 23 May 2013, Robert Navarro wrote: > > Hey David, >> >> I don't have any firewalls set that I know of, I've reached out to my >> provider to confirm. >> >> The server in question is running Ubuntu 12.04.2 LTS >> >> root@cron2# rsyslogd -v >> rsyslogd 5.8.6, compiled with: >> FEATURE_REGEXP: Yes >> FEATURE_LARGEFILE: No >> GSSAPI Kerberos 5 support: Yes >> FEATURE_DEBUG (debug build, slow code): No >> 32bit Atomic operations supported: Yes >> 64bit Atomic operations supported: Yes >> Runtime Instrumentation (slow code): No >> >> I've also attached a copy of the servers' kernel system variables...I >> didn't see anything that stood out to me...but maybe I'm missing >> something. >> >> Let me know if you need any additional debug information. >> >> >> >> On Wed, May 22, 2013 at 9:55 PM, David Lang <[email protected]> wrote: >> >> what version of rsyslog is this? >>> >>> I don't remember seeing anything like this before. Rainer is out >>> (presenting at Linuxtag I believe) this week >>> >>> TCP should only be able to drop messages when the connection is cut. Do >>> you have a firewall in between your source and destination that may have >>> some sort of timeout or other limit? >>> >>> David Lang >>> >>> On Wed, 22 May 2013, Robert Navarro wrote: >>> >>> Date: Wed, 22 May 2013 17:38:49 -0700 >>> >>>> From: Robert Navarro <[email protected]> >>>> Reply-To: rsyslog-users <[email protected]> >>>> To: [email protected] >>>> Subject: [rsyslog] Dropped Log Debug >>>> >>>> >>>> Hello, >>>> >>>> I'm trying to debug some log dropping issues and I notice lines like >>>> this >>>> in the debug output: >>>> >>>> 3119.633279579:7ff32b5d5700: TCP sent 16384 bytes, requested 25903 >>>> 3119.633300017:7ff32b5d5700: message not completely (tcp)send, ignoring >>>> 16384 >>>> >>>> 3119.669879126:7ff32b5d5700: TCP sent 16384 bytes, requested 63433 >>>> 3119.669908446:7ff32b5d5700: message not completely (tcp)send, ignoring >>>> 16384 >>>> >>>> 3121.689679357:7ff32b5d5700: TCP sent 16384 bytes, requested 105302 >>>> 3121.689780045:7ff32b5d5700: message not completely (tcp)send, ignoring >>>> 16384 >>>> >>>> is that cause for concern? >>>> >>>> What other things should I be looking at to help debug this? >>>> >>>> The output above was generated using the following command: >>>> rsyslogd -c5 -dn > log.txt >>>> >>>> >>>> ______________________________****_________________ >>>> >>> rsyslog mailing list >>> http://lists.adiscon.net/****mailman/listinfo/rsyslog<http://lists.adiscon.net/**mailman/listinfo/rsyslog> >>> <http:**//lists.adiscon.net/mailman/**listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> >>> > >>> http://www.rsyslog.com/****professional-services/<http://www.rsyslog.com/**professional-services/> >>> <http://**www.rsyslog.com/professional-**services/<http://www.rsyslog.com/professional-services/> >>> > >>> >>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>> DON'T LIKE THAT. >>> >>> >> >> >> > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > -- Robert Navarro Lead Backend Developer [email protected] www.stitchlabs.com <http://www.stitchlabs.com/>San Francisco, CA _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
