Greetings all, I appear to have run into an issue with 4.5.5 where queues are not being flushed in a timely manner. In this specific case, I have data from last wednesday that is being written to disk in small chunks today since last wednesday. Unfortunately I cannot be too specific in details, but here is what I can see:
Using omfile+gzip, there appears to have been a decent burst in traffic sometime last wednesday. The rsyslog instance has grown to 1.8GB of memory and stayed there for a while. I have both main message and action queues defined using fixedarray, and I see no on-disk queues (appears to be entirely in memory). I've got templates writing out to filenames using an hourly timestamp (filenames like: [token]-[host]-YYYYMMDD-HH.txt.gz) In some of those files, all of them less than 5k in size, there are between 5 and 15 lines of content, all of them from last wednesday, and within a few seconds of each other. It's almost like there was a significant queue built up, the hour rolled over, and only the first block of lines were pulled from the queue. Then the hour rolled over again, and another block of lines were pulled from the queue. Then the next hour, then another 5-15 lines. Is it possible that one of the queues still has a good chunk of data built up, and is flushing it out very slowly? It hasn't been consistantly at the top of the hour either, and not every hour. But the log lines themselves are sequentially written out, and usually the lines are within a few seconds of each other. For example: syslog-myhost-20091102-18.txt.gz: 3 lines, 2 with TS Oct 21 18:46:34 and one 18:46:35 syslog-myhost-20091102-19.txt.gz: 17 lines, 3 Oct 21 18:46:35, 14 lines Oct 21 18:46:36 syslog-myhost-20091102-20.txt.gz: 12 lines, 8 Oct 21 18:46:36, 4 lines Oct 21 18:46:37 Thoughts? -Aaron _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
