rsyslogd is acting quite strangely for me on an Ubuntu Linux
system. Sometimes it writes messages to the relevant log files
immediately; sometimes it seems to treasure them up in a buffer
somewhere and write them some time later.
What I mean by "sometimes it writes immediately" is that it
literally cycles into and out of this mode, with a cycle time on
the order of minutes. For example, just now, with a loop like
while sleep 1; do logger hello world `date`; done
running to keep the log messages flowing, I observe that for 30
seconds the messages show up in /var/log/messages immediately,
then for 134 seconds no messages appear, then all the missing
messages show up at once and for 30 more seconds messages appear
in real time, followed by another 134-second blackout, etc.
Last week, when I first started investigating this, I sometimes
observed that the periods of real-time logging lasted for 60
seconds, not 30. The "blackouts" are very consistent at 134
seconds. I haven't tried to determine whether the timing is in
any way based on the volume of data logged, although that's an
obvious question.
At first I assumed this had something to do with "file syncing"
and that setting $ActionFileEnableSync would help, but (a) it
didn't, and (b) the documentation says that this option is a
dangerous performance killer that I shouldn't use unless I really
know what I'm doing, and (c) I can't imagine that the cycling I'm
seeing, between instantaneous versus buffered logging, is normal
or expected or desirable anyway, in any mode.
This is happening under Ubuntu 22.04.1, rsyslogd version
8.2112.0. Also, it's an AWS abstract machine instance, which
I suppose might have something to do with this.
I'd really like to fix this. I'm debugging autonomy programs
that log using rsyslog, and I really need real-time or near
real-time logging; I can't wait for up to 134 seconds to see
whether a log message appeared or not.
Later today I'll post the exact configuration files from the
machine in question, in case they're useful.
Thanks for your help,
Steve Summit
Disclaimer #1: The log I'm actually having trouble with is one of
my own, custom ones, not /var/log/messages. But since the same
problem shows up with /var/log/messages, and with all my custom
configurations removed, it seems easier to ask about it that way,
without my customizations clouding the issue.
Disclaimer #2: I have asked this question on Stack Exchange
yesterday, at https://unix.stackexchange.com/questions/796421 .
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
