Does this mean the queued files are not being transferred over to the remote logging host at all? Or after some delay? A tcpdump might show whether we are getting any data flow.
Other than that, running rsyslog in debug mode can help. However, I will let Andre/Rainer to have more irrefutable debugging methods. I have seen this kind of issue in v5 on rhel6 and Thomas Heinric worked out on a configuration which eliminated the problem. TBH, I still don't know what the problem was. Soham On Wed, May 8, 2013 at 10:17 PM, Fajun Chen <[email protected]> wrote: > I upgraded ubuntu rsyslog to 7.3.14 and still got the same issue. > > My test procedure: > Clean log file. Set remote host IP to 127.255.255.1 (invalid IP) in rsyslog > conf. service rsyslog restart followed by logger in a loop. The disk queue > files are buffered but are limited to 96M overall. Set remote host IP to > valid IP. service rsyslog restart. I expect the queued files to be flushed > to the remote host but these files are still in the queuing directory. > > This is very reproducible, please let me know if you need to collect any > debugging data. > > Thanks, > > > On Wed, May 8, 2013 at 7:54 AM, Andre Lorbach <[email protected]> > wrote: > > > > > Hi, > > > > > > > > I use disk-assisted queue to buffer logs when remote logging host is > > > > unavailable or network is down. The problem I ran into is when the > > > > disk queue hits the maximal disk space limit, it stops accepting > > > > incoming logging entries as expected, but it doesn't flush existing > > > > queued entries when the remote host is back to normal. If the remote > > > > host is set before maximal disk space limit is reached, it works > > > > without issues. I tested on rsyslog 5.8.6, > > > > 5.8.13 and 7.3.13, neither seems to be working. > > > > > > > > My rsyslog configuration on sending end: > > > > # start forwarding rule 1 of 1 > > > > $ActionQueueType LinkedList > > > > $ActionQueueFileName srvrfwd > > > > $ActionResumeRetryCount -1 > > > > $ActionQueueSaveOnShutdown on > > > > $ActionQueueMaxDiskSpace 100000000 > > > > $ActionQueueSize 200000 # Tried 100000 as well > > > > $ActionQueueHighWaterMark 600 > > > > $ActionQueueLowWaterMark 200 > > > > $ActionQueueTimeoutEnqueue 1 > > > > > > > > #local5.* :omrelp:127.255.255.1:20514 # Invalid IP to trigger log > > > > buffering > > > > local5.* :omrelp:172.17.5.28:20514 # Real IP to trigger log > > > > forwarding > > > > # end forwarding rule 1 of 1 > > > > > > > > Has anyone seen similar issues? > > > > > > > > Thanks, > > > > Fajun > > > > > > I've seen a similar issue with the 5.8.x versions. > > > 7.2.5 has not had this problem. I'm using the rpms from the adison > repo > > and > > > running centos 5.9. > > > > > > When I have been testing this, I shutdown the rsyslog receiver to force > > the > > > client to start queueing logs. When I start the syslog receiver, the > > client will > > > start sending logs. > > > If I have the client machine under considerable load, it doesn't send > > the > > > queued logs immediately but will eventually. > > > > > > (I create log volume with "find / -print | logger" for example). > > > > Can you use test and try the new v7 devel build from our rpm repository? > > It has been updated to 7.3.14 today. > > > > Best regards, > > Andre Lorbach > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
