David, I have done a quick and dirty (not to stay) fix, which makes imuxsock a NO_DELAY input:
http://download.rsyslog.com/rsyslog/rsyslog-3.21.3-Test4.tar.gz I'd appreciate if you could give it a try and report back. Rainer > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:rsyslog- > [EMAIL PROTECTED] On Behalf Of Rainer Gerhards > Sent: Friday, August 08, 2008 12:28 PM > To: rsyslog-users > Subject: Re: [rsyslog] Problems with spooling to disk > > Thanks, I now received the log files. And, of course, they made > immediately clear what is going on ;) What you experience is flow > control kicking in. Let me first elaborate a bit: > > Rsyslog knows inputs which can be delayed a bit (like tcp receiver AND > the local socket) and those who can not (like UDP). The idea is that we > can slow down senders where this does not result in loss of messages, > leaving room inside the queue on busy systems for those where we can > not > do that. We had cases where not delaying caused a lot of grief. > > There are also two watermarks, the low and high delay mark. If the low > delay mark is reached, a delayable source is delayed for one second. It > is at 70% of the (in-memory) queue capacity. Again, this is all done > for > some very good reasons. > > However, when I introduced these features, I did not make them > configurable. Also, I did classify the local unix socket as one who can > be delayed. In your scenario, this does not stop the system, but once > the local log socket is filled up, it needs to wait one second for each > message before it is pulled. > > Again, the rate limiting logic is there for good reasons. So what I now > see is that I need to add a few config statements to allow to control > it > according to your needs. I am also unsure if I should re-classify > imuxsock as an input which cannot be delayed - but that also can have > some drawbacks. Maybe the best thing to do is make its state > configurable and use "not to be delayed" as default. > > Anyone with a thought on that? > > Rainer > > > -----Original Message----- > > From: [EMAIL PROTECTED] [mailto:rsyslog- > > [EMAIL PROTECTED] On Behalf Of Rainer Gerhards > > Sent: Thursday, August 07, 2008 2:19 PM > > To: rsyslog-users > > Subject: Re: [rsyslog] Problems with spooling to disk > > > > >From what I see, this should work. So please send the debug log, > > client > > (more important) and server please :) > > > > Thanks, > > Rainer > > > > > -----Original Message----- > > > From: [EMAIL PROTECTED] [mailto:rsyslog- > > > [EMAIL PROTECTED] On Behalf Of David Darville > > > Sent: Thursday, August 07, 2008 2:06 PM > > > To: [email protected] > > > Subject: [rsyslog] Problems with spooling to disk > > > > > > Hello everybody > > > > > > Now I'm trying to configure rsyslog to spool log messages to disk, > > > while the > > > connection to the central log collector is down. But it does not > > > work...... > > > > > > I am using rsyslog v 3.21.2 > > > > > > I have configured the client rsyslog like this: > > > > > > $ModLoad imuxsock > > > $ModLoad omrelp > > > $WorkDirectory /var/spool/rsyslog > > > $ActionQueueType LinkedList > > > $ActionQueueFileName rsyslog-buffer > > > $ActionResumeRetryCount -1 > > > $ActionQueueSaveOnShutdown on > > > *.* :omrelp:172.16.0.43:2514 > > > > > > Which is similar to the reliable forwarding configuration from the > > > documentation, except that I prefer to use RELP. > > > > > > But When I test it, by stopping rsyslog on the central log > collector, > > > and > > > running this small shell script on the client: > > > > > > #! /bin/sh > > > for ((i=1;i<=10000;i+=1)); do > > > logger Log line $i > > > done > > > > > > The shell script does not complete until I restart rsyslog, on the > > > central > > > log collector, and when I look at the timestamps in the logfile on > > the > > > log > > > collector, I see a large time difference between log line 3303 and > > > 3304. > > > > > > My plan is to get rsyslog to spool all log entries locally, while > the > > > connection the the central log collector is interrupted, and then > > flush > > > all > > > the spooled log messages to the central log collector when the > > > communication > > > is restored - while the rest of the client system continues with > > > business as > > > usual. > > > > > > I can send you a debug log is needed. > > > > > > > > > -- David Darville > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog
