That's true. It's typical for distro-based services to be prepared for
"normal" use cases.
Since I often use a second instance of rsyslogd process - separate from
the main distro-provided one, running with separate user and so on - I
have my own unit file which waits up to a minute or so before sigkill.
In case of a need for "extreme" reliability without the performance
penalty, I think I'd go for memory backed queue but I'd also add
secondary action to write an event locally to a file. This way if an
event wasn't delivered, it could be re-read from the file manually.
On 26.12.2021 18:30, David Lang via rsyslog wrote:
the save on shutdown is at least partially defeated on many distros in
that the shutdown process only gives rsyslog a few seconds to shutdown
gracefully (saving the queue) and then does a kil -9 on it (there is a
systemd config to change this timeing)
disk queues are safer, but in my tests were slower by a factor of
~100x (and that was using a $5k PCI based SSD)
David Lang
On Sun, 26 Dec 2021, Mariusz Kruk via rsyslog wrote:
Date: Sun, 26 Dec 2021 15:41:08 +0100
From: Mariusz Kruk via rsyslog <[email protected]>
To: [email protected]
Cc: Mariusz Kruk <[email protected]>
Subject: Re: [rsyslog] Guaranteed message delivery
Apart from all the obvious stuff about reliablility that we wrote
earlier, your config creates a memory queue. It only writes to disk
in case of overfilling the memory queue (if the queue grows over the
queue.highwatermark size). So in a typical case, the queue is stored
in memory and if the process is killed, the queue contents are lost.
The saveonshutdown option indeed should cause the rsyslog daemon to
write the queue contents to the disk and reload them on restart but
it all depends on how the process is being shut down and whether the
rsyslogd process is actually able to create and write the buffer
files (there are several factors that can prevent it - selinux,
directory permissions, the process can be killed with SIGKILL).
Memory-based disk-assisted queues are memory-bound so they are prone
to message loss in case of the process crash. If you want "extreme"
reliability, you should use disk-based queues but be aware that they
offer much lower performance.
On 24.12.2021 10:23, Dmitrii Chernov via rsyslog wrote:
Hello to all.
I am sending it from another mailbox, as there were problems with
reading
the letter.
I am trying to set up a rsyslog so that the message is not lost when
transmitted over the network using the RELP protocol.
Server settings:
module(load="imrelp")
input(type="imrelp" port="20514")
Client settings:
module(load="omrelp")
*.* action(type="omrelp" Target="192.168.0.100" Port="20514"
queue.type="LinkedList" queue.size="10000"
queue.filename="q_sendToLogserver" queue.highwatermark="9000"
queue.lowwatermark="50" queue.maxdiskspace="500m"
queue.saveOnShutdown="on"
action.resumeRetryCount="-1"
action.reportSuspension="on" action.reportSuspensionContinuation="on"
action.resumeInterval="10")
Messages are lost if the server is disconnected from the network and
the
client's PC is rebooted. Enabling the saveOnShutdown option should
prevent
the loss of messages, but it doesn't.
Is it possible to configure the client so that messages are not lost in
this case?
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
