Hi,
> this could probably have something todo with the select limit. The question
> is if this is imrelp or not.
>
> While the CPU is busy, can you continue to receive RELP messages? If so, is
> output written?
new RELP messages are received, the conditional splitting and the
dynamic filenames work correctly, and yes, new output is written to the
correct files. (At least that's what I can see when testing with custom
messages from different hosts to different facilities, there are so many
active logfiles on the production server that it could be possible that
something is lost without being noticed)
> Also, is it possible to enable run rsyslog in debug mode? That would enable
> me to see where exactly the problem is. I guess it will be problematic,
> because debug logs quickly get rather large. But it would be useful.
I'm a bit skeptic at this, because the problem only comes up after some
days of usage. The rsyslog server and some clients are also in
production and produce a lot of traffic. So I guess the debug log would
grow to several GiB already before the problem even arises.
Perhaps it's better to try to reproduce it first on a test-bed. I'll
look into it, but I will need something like tcpflood.c for RELP with
the ability to pass custom <hostname> <facility> <priority> <message>
(so I can emulate the real traffic and cause all splitting/dynamic stuff
to occur) :-)
BTW, thinking more about it... since the problem always occurs after
some days - perhaps it is related to using %$now% within the filename
templates in combination with the $DynaFileCacheSize?
The lsof shows a lot of open FDs ("REG") for "(deleted)" files of
previous days. FD leaking?
> I would also appreciate if you could add a bug to the bug tracker at
> http://bugzilla.adiscon.com as this enables me to keep track of the issue
> (and others can better find it if they experience the same issue).
http://bugzilla.adiscon.com/show_bug.cgi?id=208
Thanks,
John
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
