the save on shutdown is at least partially defeated on many distros in that the
shutdown process only gives rsyslog a few seconds to shutdown gracefully (saving
the queue) and then does a kil -9 on it (there is a systemd config to change
this timeing)
disk queues are safer, but in my tests were slower by a factor of ~100x (and
that was using a $5k PCI based SSD)
David Lang
On Sun, 26 Dec 2021, Mariusz Kruk via rsyslog wrote:
Date: Sun, 26 Dec 2021 15:41:08 +0100
From: Mariusz Kruk via rsyslog <[email protected]>
To: [email protected]
Cc: Mariusz Kruk <[email protected]>
Subject: Re: [rsyslog] Guaranteed message delivery
Apart from all the obvious stuff about reliablility that we wrote earlier,
your config creates a memory queue. It only writes to disk in case of
overfilling the memory queue (if the queue grows over the queue.highwatermark
size). So in a typical case, the queue is stored in memory and if the process
is killed, the queue contents are lost.
The saveonshutdown option indeed should cause the rsyslog daemon to write the
queue contents to the disk and reload them on restart but it all depends on
how the process is being shut down and whether the rsyslogd process is
actually able to create and write the buffer files (there are several factors
that can prevent it - selinux, directory permissions, the process can be
killed with SIGKILL).
Memory-based disk-assisted queues are memory-bound so they are prone to
message loss in case of the process crash. If you want "extreme" reliability,
you should use disk-based queues but be aware that they offer much lower
performance.
On 24.12.2021 10:23, Dmitrii Chernov via rsyslog wrote:
Hello to all.
I am sending it from another mailbox, as there were problems with reading
the letter.
I am trying to set up a rsyslog so that the message is not lost when
transmitted over the network using the RELP protocol.
Server settings:
module(load="imrelp")
input(type="imrelp" port="20514")
Client settings:
module(load="omrelp")
*.* action(type="omrelp" Target="192.168.0.100" Port="20514"
queue.type="LinkedList" queue.size="10000"
queue.filename="q_sendToLogserver" queue.highwatermark="9000"
queue.lowwatermark="50" queue.maxdiskspace="500m" queue.saveOnShutdown="on"
action.resumeRetryCount="-1"
action.reportSuspension="on" action.reportSuspensionContinuation="on"
action.resumeInterval="10")
Messages are lost if the server is disconnected from the network and the
client's PC is rebooted. Enabling the saveOnShutdown option should prevent
the loss of messages, but it doesn't.
Is it possible to configure the client so that messages are not lost in
this case?
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
