On Sat, Sep 28, 2013 at 1:47 PM, David Lang <[email protected]> wrote:
> On Sat, 28 Sep 2013, Rainer Gerhards wrote:
>
> On Sat, Sep 28, 2013 at 6:15 AM, David Lang <[email protected]> wrote:
>>
>> I've got a box that's getting a fair number of errors on sending UDP
>>> messages. I don't understand how that can generate failures.
>>>
>>> this is a pretty simple config, local logs get some metadata added to
>>> them
>>> and sent off, logs from remote systems are forwarded to a list of
>>> destiantions. no tests other than the one fromhost list.
>>>
>>>
>>> mmhhh.. The only idea I currently have is that something actually goes
>> wrong during the sendto() call. An other option would be failing name
>> resultion, but given it is using IP addresses...
>>
>> I suggest running rsyslog in debug mode. omfwd emits error messages to the
>> debug log if something goes wrong (but does not do so in regular mode, as
>> this could lead to an enourmous amount of messages and even a DoS loop if
>> they are tried to being forwarded).
>>
>
> is there any way to just put the one module in debug mode?
Unfortunately not.
> this is a fairly high throughput system and the errors are rare enough
> that it will probably take a while to hit them.
>
> 2013-09-25T09:35:54.854363-07:**00 oprdelica300 rsyslogd-pstats: @cee:
> {"name":"main Q","size":12,"enqueued":**730769821,"full":0,"discarded.**
> full":0,"discarded.nf":0,"**maxqsize":12848}
>
>
> 2013-09-25T09:40:54.937589-07:**00 oprdelica300 rsyslogd-pstats: @cee:
> {"name":"main Q","size":20,"enqueued":**732940254,"full":0,"discarded.**
> full":0,"discarded.nf":0,"**maxqsize":12848}
>
> 5 min, 2m logs, nowhere close to a peak time (and no failures during this
> time, so it's got to be load related)
>
I got another idea, which probably is useful in general. I think I add a
config parameter that tells imudp to actually emit error messages for the
first n errors, with default being very low (maybe 10 or so). Even if set
to much higher number, that would prevent "bad thing" from happening ;)
Rainer
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
