Running rsyslog 8.2001 on Debian 10 we do monitor file changes with use of iWatch [1]. Within monitoring we occasionally see a lot of messages Aug 26 00:01:10 loco iWatch[3575]: * /chroot/net/var/spool/rsyslog/mainq.qi.tmp is moved to /chroot/net/var/spool/rsyslog/mainq.qi Aug 26 00:01:10 loco iWatch[3575]: * /chroot/net/var/spool/rsyslog/mainq.qi.tmp is moved to /chroot/net/var/spool/rsyslog/mainq.qi and sometimes Aug 26 00:01:10 loco iWatch[3575]: * /chroot/net/var/spool/rsyslog/mainq.qi.tmp is closed or other messages regarding the closing and deleting the message queue files.
There are 1564 messages logged within one second causing the filesystem being full. Where 1427 are related to main.qi.tmp being moved to main.qi file. Seems the queue index file is always open in "sync" mode and the queue.checkpointinterval [2] and queue.syncqueuefiles [3] are used for the message queue files only. Is that assumption correct? Is there any way to modify the queue index file handling? Thank you. [1] http://iwatch.sourceforge.net/index.html [2] https://www.rsyslog.com/doc/master/rainerscript/queue_parameters.html#queue-checkpointinterval [3] https://www.rsyslog.com/doc/master/rainerscript/queue_parameters.html#queue-syncqueuefiles -- Peter _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
