You're right. I managed to skip the file name returned by grep. Thanks.
I was digging a bit and it turns out that doEnqSingleObj() in queue.c has
only DBGOPRINT directives for these messages:
- enqueueMsg: queue FULL - waiting to drain
- enqueueMsg: cond timeout, dropping message!
The second one is followed by ABORT_FINALIZE and it will return an error
which can lead to the situation I described. That's the only such
condition in the code I found and my disk queues do get filled up from
time to time, while the testing period lasts.
I have 23 such messages per day, but only one day of testing. I think it
should be logged to give an administrator an indication about what's going
on.
The patch is attached, but I'm not sure if it's good. I'd very much like
to know which queue is having problems, so I'm trying to print its name. I
don't know what's set in objData.pszName nor whether a casual
administrator can link it to the stuff that goes in the config file, so
the first choice is file prefix for disk queues, then objData.pszName and
then "unnamed queue". I'd be grateful if you can suggest a better
alternative.
Rainer Gerhards wrote:
> This from ./tcpsrv.c, not gssapi. There seems to be some condition triggered
> which does not emit a message by itself, maybe removed because it occurred
> too frequently.
>
> Rainer
>
> > -----Original Message-----
> > From: [email protected] [mailto:rsyslog-
> > [email protected]] On Behalf Of Dražen Kacar
> > Sent: Wednesday, January 19, 2011 12:10 PM
> > To: [email protected]
> > Subject: [rsyslog] Tearing down TCP Session in the log file
> >
> > Hello.
> >
> > I have rsyslog 5.6.2 and I just tried to receive messages via TCP. The
> > sender is syslog-ng, I don't know exactly which version, not under my
> > control. The transfer mostly works, as far as I can see without strict
> > testing.
> >
> > But in rsyslog's log file I see several messages which look like this:
> >
> > rsyslogd-2105: Tearing down TCP Session - see previous messages for
> > reason(s)
> > [try http://www.rsyslog.com/e/2105 ]
> >
> > And then there is no previous message which is different than this one
> > and
> > if I go back far enough there is the startup message. There's nothing
> > else in the log (produced by the *.* selector at the end of the config
> > file).
> >
> > I tried to check the URL above, but I'm getting an error page with
> > says:
> >
> > Fatal error: Call to undefined function SendEmailToAdiscon() in
> > /home/adisconweb/www/kb.monitorware.com/kbeventdb.php on line 217
> >
> > That's generated by
> > http://kb.monitorware.com/kbeventdb-list-1-Adiscon-rsyslog-rsyslogd-
> > 2105.html
> >
> > I checked the source and the only file with the above message is
> > plugins/imgssapi/imgssapi.c in the
> >
> > if(tcps_sess.DataRcvd(pSess, buf, ret) ! = RS_RET_OK)
> >
> > block. I didn't even know I was using gssapi plugin. My configuration
> > related to TCP is:
> >
> > $ModLoad imtcp
> > $InputTCPServerBindRuleset indata
> > $InputTCPServerRun 514
> >
> > and the rest is setup for the UDP receiver and storing messages. I
> > checked
> > with Google and rsyslog bug tracker for "Tearing down TCP Session", but
> > with zero results (except for the source code matches).
> >
> > I am willing to debug this and submit a patch (which would at least log
> > the missing previous message), but before I do, I'd just like to ask if
> > someone has seen this before or has any idea what's going on. I'm a bit
> > confused with gssapi module being used. My OS is CentOS 5.5, if that's
> > relevant.
> >
> > --
> > .-. .-. Yes, I am an agent of Satan, but my duties are largely
> > (_ \ / _) ceremonial.
> > |
> > | [email protected]
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com
--
.-. .-. Yes, I am an agent of Satan, but my duties are largely
(_ \ / _) ceremonial.
|
| [email protected]
--- queue.c.orig 2011-01-19 13:15:51.000000000 +0100
+++ queue.c 2011-01-19 14:01:36.000000000 +0100
@@ -2227,7 +2227,16 @@
timeoutComp(&t, pThis->toEnq);
// TODO : handle enqOnly => discard!
if(pthread_cond_timedwait(&pThis->notFull, pThis->mut, &t) != 0) {
+ uchar *qname;
+
+ if (pThis->pszSpoolDir && pThis->pszFilePrefix)
+ qname = pThis->pszFilePrefix;
+ else if (pThis->objData.pszName != NULL)
+ qname = pThis->objData.pszName;
+ else
+ qname = "unnamed queue";
DBGOPRINT((obj_t*) pThis, "enqueueMsg: cond timeout, dropping message!\n");
+ errmsg.LogError(0, NO_ERRCODE, "enqueueMsg: queue '%s' full, timeout (%d msec) reached, dropping message.", qname, pThis->toEnq);
objDestruct(pUsr);
ABORT_FINALIZE(RS_RET_QUEUE_FULL);
}
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
