Hi, Thanks for the reply. Though after I wrote my mail I switched my brain on and realized that we don't actually store anything from journal. We only use forwarding to socket, and then I guess the imjournal approach doesn't work.
It seems like the kernel guys aren't keen on making the max_dgram_qlen a per socket setting so the problem still exists. We are thinking of solutions like a "pre" and "post" condition to when creating the socket. Doing a sysctl set increasing the limit before the forwarding socket is created, then create the socket and afterwards reset the limit to default. However there is still a risk (with systemd) that other sockets are created in parallell during that timeframe so its still an open question. Br, Jonny On Tue, Jul 09, 2013 at 05:20:39PM +0200, David Lang wrote: > I would suggest that you use imjournal instead. That interface works by > allowing > the journal to write it's files and then rsyslog uses the journal interface > to > query for new logs. > > Make sure you are running the latest version (both systemd and rsyslog) > because > there is a bug in earlier versions of systemd that result in a endless loop > when > reading the journal files. > > David Lang > > On Fri, 5 Jul 2013, Jonny T?rnbom wrote: > > > Hi, > > > > We're currently using systemd in our embedded environment. With that we > > are also using rsyslog, which fetches messages through the forwarding > > socket provided by journald. > > > > The problem we run into is that the time in between journal.socket is > > created and rsyslog.service is started is so long that the socket gets > > full. > > > > Now when looking at the default configuration in systemd, it's set to > > 8MB, however the /proc/sys/net/unix/max_dgram_qlen is default defaulting > > to 10. This means that only 10 (actually 11) messages will be queued up > > in the socket and everything after that will be lost up until something > > starts reading from the socket == rsyslog starts. > > > > Now of course this mostly affects bootup, but I'd like to hear your > > ideas and thoughts around it. Of course one could change the > > max_dgram_qlen size, but thats a global setting, and starting rsyslog as > > early as possible after journal.socket isn't necessarily enough if > > anything in between is pumping out more than 11 messages. > > > > Any ideas/thougts? (I've just now quickly read about imjournal, perhaps > > it might be a solution?) > > > > Br, > > Jonny > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > > LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
