> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of David Lang > Sent: Tuesday, December 18, 2012 2:22 PM > To: rsyslog-users > Subject: Re: [rsyslog] rsyslogd buffering logs? > > On Tue, 18 Dec 2012, bodik wrote: > > >>> #forward1 > >>> $ActionQueueType LinkedList # use asynchronous processing > >>> $ActionQueueFileName srvrfwd1 # set file name, also enables disk > mode > >>> $ActionResumeRetryCount -1 # infinite retries on insert failure > >>> $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog > shuts down > >>> $ActionQueueMaxDiskSpace 100m # limit disk cache > >>> $ActionQueueTimeoutEnqueue 100 # dont block worker indefinitely > when cache > >>> *.* @@loghost:515 > >> > >> This is one option (overflow to disk). Note that if the disk > >> partition that the spool file is on fills up (100m in your config) > >> the exact same blocking can happen again. > > > > hmm?? > > > > I thought that this is the part where ActionQueueTimeoutEnqueue comes > > into play, that rsyslog will not stop working at all, because new > > messages which cannot be queued are discarded after 100ms of waiting for > enqueueing, or am I wrong ? > > that insert will fail, but since you have retrycount set to -1 it will try > again > rather than discarding the message (and do so forever) > > I could be mistaken on this, Rainer can confirm this.
You are both kind of right ;) The enqueue into the action queue will fail, and at that point the message will be discarded. That at 100ms, this means 10 msgs per second can be discarded. If the rate is higher, the still begin to fill the main queue. In regard to retry, -1 really means "indefinite", but that happens at the "async side" of the queue, so it does not affect the main queue. Does that help? Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
