Thanks, I now received the log files. And, of course, they made immediately clear what is going on ;) What you experience is flow control kicking in. Let me first elaborate a bit:
Rsyslog knows inputs which can be delayed a bit (like tcp receiver AND the local socket) and those who can not (like UDP). The idea is that we can slow down senders where this does not result in loss of messages, leaving room inside the queue on busy systems for those where we can not do that. We had cases where not delaying caused a lot of grief. There are also two watermarks, the low and high delay mark. If the low delay mark is reached, a delayable source is delayed for one second. It is at 70% of the (in-memory) queue capacity. Again, this is all done for some very good reasons. However, when I introduced these features, I did not make them configurable. Also, I did classify the local unix socket as one who can be delayed. In your scenario, this does not stop the system, but once the local log socket is filled up, it needs to wait one second for each message before it is pulled. Again, the rate limiting logic is there for good reasons. So what I now see is that I need to add a few config statements to allow to control it according to your needs. I am also unsure if I should re-classify imuxsock as an input which cannot be delayed - but that also can have some drawbacks. Maybe the best thing to do is make its state configurable and use "not to be delayed" as default. Anyone with a thought on that? Rainer > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:rsyslog- > [EMAIL PROTECTED] On Behalf Of Rainer Gerhards > Sent: Thursday, August 07, 2008 2:19 PM > To: rsyslog-users > Subject: Re: [rsyslog] Problems with spooling to disk > > >From what I see, this should work. So please send the debug log, > client > (more important) and server please :) > > Thanks, > Rainer > > > -----Original Message----- > > From: [EMAIL PROTECTED] [mailto:rsyslog- > > [EMAIL PROTECTED] On Behalf Of David Darville > > Sent: Thursday, August 07, 2008 2:06 PM > > To: [email protected] > > Subject: [rsyslog] Problems with spooling to disk > > > > Hello everybody > > > > Now I'm trying to configure rsyslog to spool log messages to disk, > > while the > > connection to the central log collector is down. But it does not > > work...... > > > > I am using rsyslog v 3.21.2 > > > > I have configured the client rsyslog like this: > > > > $ModLoad imuxsock > > $ModLoad omrelp > > $WorkDirectory /var/spool/rsyslog > > $ActionQueueType LinkedList > > $ActionQueueFileName rsyslog-buffer > > $ActionResumeRetryCount -1 > > $ActionQueueSaveOnShutdown on > > *.* :omrelp:172.16.0.43:2514 > > > > Which is similar to the reliable forwarding configuration from the > > documentation, except that I prefer to use RELP. > > > > But When I test it, by stopping rsyslog on the central log collector, > > and > > running this small shell script on the client: > > > > #! /bin/sh > > for ((i=1;i<=10000;i+=1)); do > > logger Log line $i > > done > > > > The shell script does not complete until I restart rsyslog, on the > > central > > log collector, and when I look at the timestamps in the logfile on > the > > log > > collector, I see a large time difference between log line 3303 and > > 3304. > > > > My plan is to get rsyslog to spool all log entries locally, while the > > connection the the central log collector is interrupted, and then > flush > > all > > the spooled log messages to the central log collector when the > > communication > > is restored - while the rest of the client system continues with > > business as > > usual. > > > > I can send you a debug log is needed. > > > > > > -- David Darville > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog
