when rsyslog starts up, it generates various log messages, are they being sent
to the script?
it would really help to see the queue data from impstats
David Lang
On Mon, 18 Sep 2023, TG Servers via rsyslog wrote:
I don't know what this is... I implemented a complete queue solution and
it occasionally happens when there is no request but one in sight, and
this one gets a 111 then, nothing in nginx debug log, no error to be
seen in rsyslog log
but one thing I realized, after a restart the first log message always,
reproducable gets a 111
the socket is not connected, nor listening, only after the first request
is logged/or not logged (which is logged with 111 in nginx) the socket
is connected and listening, so restarting rsyslog via systemd does not
connect/listen to/on the socket
the rsyslog debug log just tells us this :
6289.088037540:main thread : imuxsock.c: imuxsock: Opened UNIX socket
'/run/logmat' (fd 6).
[root@xxx rsyslog.d]# systemctl restart rsyslog
[root@xxx rsyslog.d]# ss -x | grep logmat
[root@xxx rsyslog.d]# lsof /run/logmat
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
rsyslogd 2097140 root 6u unix 0x0000000000000000 0t0 25300317
/run/logmat type=DGRAM (UNCONNECTED)
make a request from browser or curl
[root@xxx rsyslog.d]# lsof /run/logmat
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
rsyslogd 2097140 root 6u unix 0x0000000000000000 0t0 25300317
/run/logmat type=DGRAM (CONNECTED)
[root@xxx rsyslog.d]# ss -x | grep logmat
u_dgr ESTAB 0 0 /run/logmat 25300317 * 0
On 18/09/2023 16:34, TG Servers via rsyslog wrote:
I just wanted to add that in a further message as it came to my mind.
you were faster...
the script is definitely "slow", this is what I know for sure as it
does quite a lot of processing/analytics in the background, so even if
you trigger it from command line it can take half a sec or so.... I
can't change that, it needs to do what it does, I didn't write it
though it can handle manual fast F5 triggers in the browser without
issue and then it 111s when there are 2 requests incoming...
I thought rsyslog might handle that just well via the queue...
but then this might eventually really be the issue, and if it is, is
there anything to mitigate this from rsyslog side (in terms of own
queue for that socket or something in that direction)?
ok, will enable impstats, too when I switch back
Thanks,
Tom
On 18/09/2023 16:17, Rainer Gerhards wrote:
so far not a single 111 today, I let this run the until late evening,
and if there is stil no 111 I will put back the python script in order
because right now there are 2 possibilities, I moved the socket as
said,
and I skipped the script and just appended the message to a file
if either of the 2 things are responsible in the end I won't understand
it either :)
I don't know what the script does. But if it is slow, it may push back
to the main queue, making rsyslog unresponsive.
This is David's concern. Tomorrow, if you re-enable, you should also
enable impstats as David suggested.
Rainer
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
