> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Dag Wieers > Sent: Thursday, October 08, 2009 12:37 PM > To: rsyslog-users > Subject: Re: [rsyslog] URGENT - rsyslog stops sshd > > On Thu, 8 Oct 2009, [email protected] wrote: > > > rsyslog can be configured to accept and discard log entries when the > queue > > is full, doing this can avoid this sort of situation. > > Hi Martin, > > We were in a similar situation recently (because of a limit of open > file > descriptors) and I am very interested to learn how you can do the > above.
Well, it depends on your configuration. If you use a plain default config, this situation is expected to never happen, because we assume that log files can be written and discard messages when this is not the case. However, if you begin to configure the system to be reliable, you need to think about the implications. In almost all cases where I have seen such a problem (assuming it was not a real bug, of course), the configuration demanded reliable delivery, but it was not thought about the fact that if the message could not be delivered, the system would stall. Some organizations actually prefer this mode, so it may be useful. If you post your config, I could check if there is something in it that demands such reliability and prevents the engine from discarding messages when needed. Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
