On Mon, Feb 18, 2013 at 7:29 AM, Rainer Gerhards
<[email protected]> wrote:
>> -----Original Message-----
>> From: [email protected] [mailto:rsyslog-
>> [email protected]] On Behalf Of C. L. Martinez
>> Sent: Monday, February 18, 2013 8:11 AM
>> To: rsyslog-users
>> Subject: Re: [rsyslog] Recovering queues
>>
>> On Mon, Feb 18, 2013 at 7:09 AM, Soham Chakraborty
>> <[email protected]> wrote:
>> > On Mon, Feb 18, 2013 at 12:28 PM, C. L. Martinez
>> <[email protected]>wrote:
>> >
>> >> Hi all,
>> >>
>> >> This morning I met with this unpleasant surprise:
>> >>
>> >> Feb 16 16:58:05 syslogsrv02 kernel: Out of memory: Kill process
>> >> 23495
>> >> (rsyslogd) score 880 or sacrifice child
>> >>
>> >>
>> >> This problem was generated due to a failure in our central syslog
>> >> server. Now, I have a lot of files in rsyslog queues directories
>> >> stored. I have tried to flush them restarting rsyslog, without luck.
>> >> Can I recover these files?? How can I fix this situation??
>> >>
>> >
>> > You mean you have tried to restart rsyslogd on the central server
>> > itself and still logs from the clients are not being dumped into the
>> > central server. Is that the correct assumption.
>> >
>>
>> Nop, rsyslog is a client. I have restarted rsyslog and queued logs files are
>> not
>> forwarded to central syslog server (central syslog server is syslog-ng).
>
> The queue had a dirty shutdown, so the .qi file is either non-existant or
> damaged. There is a user-contributed fixup script under ./tools/recover_qi.pl
>
Thanks Rainer. I am trying this tool but returns me:
[root@syslog02 tools]# ./recover_qi.pl
Use of uninitialized value $opt{"basename"} in quotemeta at
./recover_qi.pl line 26.
Use of uninitialized value in regexp compilation at ./recover_qi.pl line 26.
Use of uninitialized value in opendir at ./recover_qi.pl line 27.
can't open spool: No such file or directory at ./recover_qi.pl line 27.
What rsyslog.conf file needs?? Can I configure some option??
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
