Answers to both Alan and Soham. I confirmed that the client can access the remote syslog server. I used logger to send message from the client to the server and it shows correctly on the server. These messages were also captured by tcpdump. I didn't see other network packets to the server on port 20514. These disk queue files are still there on the client.
Thanks, Fajun On Wed, May 8, 2013 at 11:13 AM, Soham Chakraborty < [email protected]> wrote: > Does this mean the queued files are not being transferred over to the > remote logging host at all? Or after some delay? A tcpdump might show > whether we are getting any data flow. > > Other than that, running rsyslog in debug mode can help. However, I will > let Andre/Rainer to have more irrefutable debugging methods. > I have seen this kind of issue in v5 on rhel6 and Thomas Heinric worked out > on a configuration which eliminated the problem. TBH, I still don't know > what the problem was. > > Soham > > > On Wed, May 8, 2013 at 10:17 PM, Fajun Chen <[email protected]> wrote: > > > I upgraded ubuntu rsyslog to 7.3.14 and still got the same issue. > > > > My test procedure: > > Clean log file. Set remote host IP to 127.255.255.1 (invalid IP) in > rsyslog > > conf. service rsyslog restart followed by logger in a loop. The disk > queue > > files are buffered but are limited to 96M overall. Set remote host IP to > > valid IP. service rsyslog restart. I expect the queued files to be > flushed > > to the remote host but these files are still in the queuing directory. > > > > This is very reproducible, please let me know if you need to collect any > > debugging data. > > > > Thanks, > > > > > > On Wed, May 8, 2013 at 7:54 AM, Andre Lorbach <[email protected]> > > wrote: > > > > > > > Hi, > > > > > > > > > > I use disk-assisted queue to buffer logs when remote logging host > is > > > > > unavailable or network is down. The problem I ran into is when the > > > > > disk queue hits the maximal disk space limit, it stops accepting > > > > > incoming logging entries as expected, but it doesn't flush existing > > > > > queued entries when the remote host is back to normal. If the > remote > > > > > host is set before maximal disk space limit is reached, it works > > > > > without issues. I tested on rsyslog 5.8.6, > > > > > 5.8.13 and 7.3.13, neither seems to be working. > > > > > > > > > > My rsyslog configuration on sending end: > > > > > # start forwarding rule 1 of 1 > > > > > $ActionQueueType LinkedList > > > > > $ActionQueueFileName srvrfwd > > > > > $ActionResumeRetryCount -1 > > > > > $ActionQueueSaveOnShutdown on > > > > > $ActionQueueMaxDiskSpace 100000000 > > > > > $ActionQueueSize 200000 # Tried 100000 as well > > > > > $ActionQueueHighWaterMark 600 > > > > > $ActionQueueLowWaterMark 200 > > > > > $ActionQueueTimeoutEnqueue 1 > > > > > > > > > > #local5.* :omrelp:127.255.255.1:20514 # Invalid IP to trigger > log > > > > > buffering > > > > > local5.* :omrelp:172.17.5.28:20514 # Real IP to trigger > log > > > > > forwarding > > > > > # end forwarding rule 1 of 1 > > > > > > > > > > Has anyone seen similar issues? > > > > > > > > > > Thanks, > > > > > Fajun > > > > > > > > I've seen a similar issue with the 5.8.x versions. > > > > 7.2.5 has not had this problem. I'm using the rpms from the adison > > repo > > > and > > > > running centos 5.9. > > > > > > > > When I have been testing this, I shutdown the rsyslog receiver to > force > > > the > > > > client to start queueing logs. When I start the syslog receiver, the > > > client will > > > > start sending logs. > > > > If I have the client machine under considerable load, it doesn't send > > > the > > > > queued logs immediately but will eventually. > > > > > > > > (I create log volume with "find / -print | logger" for example). > > > > > > Can you use test and try the new v7 devel build from our rpm > repository? > > > It has been updated to 7.3.14 today. > > > > > > Best regards, > > > Andre Lorbach > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com/professional-services/ > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > myriad > > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > > DON'T LIKE THAT. > > > > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
