you are sending the logs via TCP, which means that if the system you are sending
logs to gets backed up, logs will queue on the sending system, spilling to disk
as needed.
the bottleneck is probably on the central server, but we have no info about what
it's doing.
The go-to tool for diagnosting this sort of problem is the impstats module, but
I don't think that existed back in the 4.x days, and tracking down the
bottleneck without it is significantly harder. Is there any way you can upgrade
to a current version?
David Lang
On Mon, 2 Dec 2013, Dan Finn wrote:
Date: Mon, 2 Dec 2013 20:53:54 +0000
From: Dan Finn <[email protected]>
Reply-To: rsyslog-users <[email protected]>
To: "[email protected]" <[email protected]>
Subject: [rsyslog] rsyslog frequently queuing to disk when it should be
sending over the network
Hello,
I’m trying to get some insight into an issue that we have been seeing quite a
bit. We have some postgres servers that are quite verbose. When the servers
get busy we have an issue where they queue their logs locally instead of
sending over the network however I can’t find any reason why that would be, at
least not from a OS resource standpoint. We are running
rsyslog4-4.8.0-1.ius.el5. This is my config from the client that was having
issues : http://pastebin.com/n3XpRdMm.
I watched it queue about 10k files under /var/spool/rsyslog before I finally
had to manually delete them out because disk was filling up.
What’s the best way to get some insight into why this might be happening? Is
there a way I can enable some debug logging for the rsyslog process itself?
Any settings in our config that could be tweaked?
Thanks,
Dan
DAN FINN
Linux System Administrator
[email protected]<mailto:[email protected]>
Backcountry.com<http://www.backcountry.com/>
Competitive Cyclist<http://www.competitivecyclist.com/>
RealCyclist.com<http://www.realcyclist.com/>
Dogfunk.com<http://www.dogfunk.com/>
SteepandCheap.com<http://www.steepandcheap.com/>
Chainlove.com<http://www.chainlove.com/>
WhiskeyMilitia.com<http://www.whiskeymilitia.com/>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
