On Thu, Nov 28, 2013 at 2:07 AM, Erik Steffl <[email protected]> wrote:
> On 11/26/2013 07:06 AM, Pavel Levshin wrote: > >> >> 26.11.2013 1:20, Erik Steffl: >> >>> >>> what does the above mean exactly? It does make sense, in each case >>> the burst of messages gets in via /dev/log then is send out via RELP >>> (either to the same machine or a different one). >>> >>> Any ideas why this doesn't fix itself until the next burst of >>> messages? Any suggestions on what to do or what to investigate next? I >>> guess I could run these with strace and see what exactly they say to >>> each other (both the sender and receiver). >>> >>> >> I'm not sure why (and if) this is 'fixed' by the next burst of messages, >> but this can be somehow because next portion of messages pushes the >> queue. Perhaps it is unable to retry after suspend without a push. >> > > not sure if 'fixed' is the right word but it is always unstuck right > after next (sometime next to next) burst of messages, never at random time. > This behaviour is the same whether the period is 5 min or 15 min. > While I have been silent, I followed the ML discussion (I did not check the debug log further, though, as Pavel did excellent work here). To me, it looks like "normal" suspension code is kicking in. If an action fails, rsyslog retries once (except otherwise configured) and if it fails again, the action is initially suspended for 30 seconds. Then, retries happen and the suspension period is prolonged if they fail. It looks very much like this is the mechanism at work. However, what I don't understand is why the suspension period is so long. Out of all this, I think it would make much sense if rsyslog had the capability to report when an action is suspended and when it is resumed. I am right now adding this capability. I would suggest that when this change is ready, you apply it and we can than see what it reports (much easier than walking the debug log, and very obvious to users ;)). Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
