The most common mistake to make is to assign the queue file to be in a directory
that rsyslog doesn't have permissions to write to (especially when it's
configured to drop privilages)
David Lang
On Thu, 18 Jul 2013, Erik Steffl wrote:
I have a disk assisted omfwd queue that is set up using following action:
action(
type="omfwd"
target="some.host.com"
port="5140"
protocol="tcp"
template="json"
queue.filename="/mnt/rsyslog-queue/json"
queue.maxdiskspace="75161927680" # 70GB
queue.highwatermark="1"
)
Debugging output shows that it is set up at least sort of properly. Trying
to test it by setting invalid hostname and thge debug output shows that the
syslog will retry but I never see anything created in /mnt/rsyslog-queue/
directory (or in workdir which is set to /var/spool/rsyslog).
I thought that if queue.highwatermark is set to one then any pending
messages will be written to disk queue (I wrote tons of mesages to syslog).
Parts of the debug output (rsyslogd -dn) that I think are relevant included
(it's huge so not including everything):
5853.826938823:7fcbd0f0a780: Module builtin:omfwd processes this action.
5853.826951071:7fcbd0f0a780: template: 'json' assigned
5853.826972928:7fcbd0f0a780: nvlstGetParam: name 'queue.filename', type 13,
valnode->bUsed 0
5853.826981520:7fcbd0f0a780: nvlstGetParam: name 'queue.maxdiskspace', type
9, valnode->bUsed 0
5853.826988289:7fcbd0f0a780: nvlstGetParam: name 'queue.highwatermark', type
6, valnode->bUsed 0
5853.826996676:7fcbd0f0a780: queue param blk:
5853.827003232:7fcbd0f0a780: queue.filename: '/mnt/yummly-rsyslog-queue/json'
5853.827019502:7fcbd0f0a780: queue.size: (unset)
5853.827034609:7fcbd0f0a780: queue.dequeuebatchsize: (unset)
5853.827049381:7fcbd0f0a780: queue.maxdiskspace: 75161927680
5853.827064672:7fcbd0f0a780: queue.highwatermark: 1
5853.827080146:7fcbd0f0a780: queue.lowwatermark: (unset)
5853.827094933:7fcbd0f0a780: queue.fulldelaymark: (unset)
5853.827109870:7fcbd0f0a780: queue.lightdelaymark: (unset)
5853.827124916:7fcbd0f0a780: queue.discardmark: (unset)
5853.827139756:7fcbd0f0a780: queue.discardseverity: (unset)
5853.827154713:7fcbd0f0a780: queue.checkpointinterval: (unset)
5853.827169429:7fcbd0f0a780: queue.syncqueuefiles: (unset)
5853.827184937:7fcbd0f0a780: queue.type: (unset)
5853.827200298:7fcbd0f0a780: queue.workerthreads: (unset)
5853.827215675:7fcbd0f0a780: queue.timeoutshutdown: (unset)
5853.827231133:7fcbd0f0a780: queue.timeoutactioncompletion: (unset)
5853.827246473:7fcbd0f0a780: queue.timeoutenqueue: (unset)
5853.827261958:7fcbd0f0a780: queue.timeoutworkerthreadshutdown: (unset)
5853.827276928:7fcbd0f0a780: queue.workerthreadminimummessages: (unset)
5853.827291983:7fcbd0f0a780: queue.maxfilesize: (unset)
5853.827306760:7fcbd0f0a780: queue.saveonshutdown: (unset)
5853.827321837:7fcbd0f0a780: queue.dequeueslowdown: (unset)
5853.827337076:7fcbd0f0a780: queue.dequeuetimebegin: (unset)
5853.827352120:7fcbd0f0a780: queue.dequeuetimeend: (unset)
5853.827366865:7fcbd0f0a780: queue.cry.provider: (unset)
...
5853.855732748:7fcbd0f0a780: action 5 queue: type 3, enq-only 0, disk
assisted 0, maxFileSz 75161927680, lqsize 0, pqsize 0, child 0, full delay
970, light delay 700, deq batch size 128 starting
5853.855739888:7fcbd0f0a780: Action builtin:omfwd[0x1c39590]: queue 0x1c41ba0
started
any ideas how to debug/troubleshoot the disk queues that assist the omfwd
queues? How to make rsyslogd to write something to disk?
thanks,
erik
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
