Hi,
We have a setup with 10 satellite rsyslog servers that receive the logs
from all our application/infra servers and then sends all this logs to a
central rsyslog server.
We and average of 115k requests per 10seconds arriving on our central
rsyslog server.
One of our application owners asked us to increase the MaxMessageSize on
the application servers rsyslog and on the satellite and central rsyslog
servers in order to accommodate for some of the application big log
messages that were being truncated by rsyslog.
The biggest log we found on the application was around 1m, so we defined
$MaxMessageSize 1.5m on the application servers rsyslog and the same on
the satellite and central rsyslog servers.
After we activated this everything looked fine, but after 5 minutes the
central rsyslog server stopped logging and the satellite rsyslog servers
started spooling their messages to disk as they couldn't send them to
the central rsyslog server.
The only error we could see on the central rsyslog logs was this:
"... netstream session ... from ... will be closed due to error
[v8.24.0-52.el7 try http://www.rsyslog.com/e/2165]";
From documentation:
rsyslog error 2165
Error occured during socket rcv operation. This error code indicates
that there was a problem receiving from the remote host. Check network
connectivity to see if there is a physical problem. This can especially
occur if there is a partly-functioning network component.
After restarting rsyslog on central server it starts logging again, but
after 5 minutes stops logging again.
So for now we had to remove the MaxMessageSize parameter from the
central rsyslog.
On the satellite rsyslog servers and application servers rsyslog the
parameter is still there and has not caused any issue.
Anyone has ever experienced such an issue? Any ideas?
Best regards,
Ricardo Esteves.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
