Hello!
Yesterday my box crashed then i started to have problem with
spool/workdirectory. It's defined in this way:
$WorkDirectory /var/spool/rsyslog
$ActionQueueType LinkedList
$ActionQueueFileName dbq
$ActionResumeRetryCount -1
$MainMsgQueueMaxFileSize 512M
$MainMsgQueueSaveOnShutdown on
At the moment of crash, there were a few files dbq.00000xxxx . In first
file, with lowest number (dbq.00000098), appears zeroes form start of
file to position #001000F8 (after reboot). I'm wondering why so much
file is zeroed? Is it theme of filesystem? (its ext4, mount options:
barrier=1,data=ordered) or don't know, rsyslog keeps open file too long?
Next question is what can i do it with broken file?
- probably i should delete zeroed part of file and modify dbq.qi?
- how many messages could be lost?
- is it possible for rsyslog to skip broken part of file?
# rsyslogd -v
rsyslogd 6.1.1, compiled with:
FEATURE_REGEXP: Yes
FEATURE_LARGEFILE: Yes
FEATURE_NETZIP (message compression): Yes
GSSAPI Kerberos 5 support: No
FEATURE_DEBUG (debug build, slow code): No
Atomic operations supported: Yes
Runtime Instrumentation (slow code): No
git version: 950fe206f84322bdff755988403a9d4017ec26f4
Host is on xen, paravirtualization.
Regards!
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
