> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of David Lang > Sent: Tuesday, December 18, 2012 2:10 PM > To: rsyslog-users > Subject: Re: [rsyslog] rsyslogd buffering logs? > > On Tue, 18 Dec 2012, bodik wrote: > > >> Is that the expected behavior of rsyslog with that configuration ? > > > > I believe it is. http://www.rsyslog.com/doc/queues.html > > Yes.
Mostly, I'd say. It throws away messages when there is no other chance BUT does so at a very low rate (I think once every *two seconds*). So in practice, it looks like a complete block. In v7, I have changed that timeout to be something around 50ms, which looks much less like a complete block. But of course, at this point we lose messages. Rainer > > note that this is not a new failure that rsyslog introduces, it's the standard > behavior that syslog has had all along. > > With the traditional syslog daemon, if the TCP connection blocked, you could > not log anything, and everything that would try to log would block (it had no > internal queue to buffer things) > > Also, if you didn't log remotely and your syslog daemon was unable to write > to disk (full disk or disk error), the same thing would happen. > > >> How can we configure the TCP action in order to prevent the complete > >> locking ? > > > > http://www.rsyslog.com/doc/rsyslog_reliable_forwarding.html > > > > beside what's written there, this is my setup which I'm very fine with: > > > > #forward1 > > $ActionQueueType LinkedList # use asynchronous processing > > $ActionQueueFileName srvrfwd1 # set file name, also enables disk mode > > $ActionResumeRetryCount -1 # infinite retries on insert failure > > $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog > shuts down > > $ActionQueueMaxDiskSpace 100m # limit disk cache > > $ActionQueueTimeoutEnqueue 100 # dont block worker indefinitely > when cache > > *.* @@loghost:515 > > This is one option (overflow to disk). Note that if the disk partition that > the > spool file is on fills up (100m in your config) the exact same blocking can > happen again. > > There are also options for throwing away logs when you get too full, look for > options with 'watermark' in their names. > > A couple notes on these options (many people don't understand what's > happening here, they just copy the lines from the examples) > > setting an ActionQueueType decouples this action from the main queue. The > type can be any of the allowed types (array is the fastest) > > setting a filename on a queue (either the main queue or an action queue) > tells rsyslog that when the queue fills up, spill to disk. Make sure that the > user rsyslog is running as (including after it drops permissions) is able to > write > to these files. disk spools are very slow (especially in pre 7.2 versions, > they > got a significant improvement at that time) > > by setting it to save to disk on shutdown, rsyslog can be slow to shutdown. > > David Lang > > > > David Lang > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: > This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond > our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
