On Sun, 4 May 2014, Bill MacAllister wrote:
--On Sunday, May 04, 2014 04:03:55 PM -0700 David Lang <[email protected]> wrote:
On Sun, 4 May 2014, Bill MacAllister wrote:
I need some help understanding how to control queue behaviour. The
goal is to write messages to a file locally and also forward the
messages to a remote rsyslog server. When the remote server is
unavailable I would like message to queue up and be processed when the
server is available again. I have a configuration that works this way
but has the unwanted side-effect that both local and forwarded
messages are being help until the remote server is available again. Here
is a configuration fragment.
*.debug action(type="omfile"
file="/var/log/messages"
template="FileFormat")
*.debug action(type="omfwd"
Target="logsink-dev.stanford.edu"
Port="10514"
Protocol="tcp"
queue.FileName="default_queue"
queue.size="4000000"
queue.HighWaterMark="100000"
queue.LowWaterMark="10000"
queue.MaxDiskSpace="2g"
queue.WorkerThreads="10"
queue.TimeoutEnqueue="120000"
action.ResumeRetryCount="-1"
template="ForwardFormat")
In this configuration there are three queues: the main queue, the
queue for the omfile action and the queue for the omfwd action.
Right?
I don't see any queue for the omfile action, so I think you just
have two queues, the main queue and the omfwd queue
Oh, right. During some of my testing I had queue.type="direct", but
that didn't see to change the behaviour at all.
type=direct is the same as no queue (it's the default)
Why does the omfwd queue block the omfile queue? What am I
misunderstanding?
the omfwd queue should only block the main queue if it fills up
enable impstats and look at what happens to the queue sizes and
activity as you block the TCP connection
Here is my a sample test sequence of steps that I am using.
1. Here is a tail of syslog output from local system with pstats
output.
2014-05-04T19:06:32.206331-07:00 zoot-vm1 rsyslogd-pstats: imuxsock:
submitted=2122 ratelimit.discarded=0 ratelimit.numratelimiters=2074
2014-05-04T19:06:32.206349-07:00 zoot-vm1 rsyslogd-pstats: action 1:
processed=0 failed=0
2014-05-04T19:06:32.206353-07:00 zoot-vm1 rsyslogd-pstats: action 2:
processed=4299 failed=0
2014-05-04T19:06:32.206357-07:00 zoot-vm1 rsyslogd-pstats: action 3:
processed=4299 failed=0
2014-05-04T19:06:32.206360-07:00 zoot-vm1 rsyslogd-pstats: action 4:
processed=0 failed=0
2014-05-04T19:06:32.206362-07:00 zoot-vm1 rsyslogd-pstats: pstats:
processed=2176 failed=0
2014-05-04T19:06:32.206366-07:00 zoot-vm1 rsyslogd-pstats: pstats: size=0
enqueued=2176 full=0 discarded.full=0 discarded.nf=0 maxqsize=8
2014-05-04T19:06:32.206368-07:00 zoot-vm1 rsyslogd-pstats: main Q: size=7
enqueued=4306 full=0 discarded.full=0 discarded.nf=0 maxqsize=8
well, we don't know what your full config is, so some guessing is going to be
needed to figure out which action is which, could you name them? (add
name="something" to each action)
I'm also not seeing the entries I would expect for the queue for the remote
output
i'm wondering if you have the queue working properly. you define a lot of queue
parameters, but i don't see anywhere where you actually set the queue type.
check the starup messages to see if there are any errors (output from starting
rsyslog manually, and if nothing is there, try looking at the output with -dn
and see what is has to say about that action/queue
2. Stop rsyslog on remote system.
3. Generate several thousand syslog messages on local system using
logger.
4. The 'tail -f' on the local system records the first of the test
messages from the test and then stalls.
2014-05-04T19:06:58.861431-07:00 zoot-vm1 whm: This is Testmessage #0
we would want to see the pstats output at this point
David Lang
5. Start rsyslog on remote system and a bit later all test messages show
up on both local and remote system. Below is the pstats output from
the system right after all of the test messages are delivered.
2014-05-04T19:07:32.266456-07:00 zoot-vm1 rsyslogd-pstats: imuxsock:
submitted=5122 ratelimit.discarded=0 ratelimit.numratelimiters=5073
2014-05-04T19:07:32.266470-07:00 zoot-vm1 rsyslogd-pstats: action 1:
processed=0 failed=0
2014-05-04T19:07:32.266474-07:00 zoot-vm1 rsyslogd-pstats: action 2:
processed=4308 failed=0
2014-05-04T19:07:32.266478-07:00 zoot-vm1 rsyslogd-pstats: action 3:
processed=4308 failed=0
2014-05-04T19:07:32.266481-07:00 zoot-vm1 rsyslogd-pstats: action 4:
processed=0 failed=0
2014-05-04T19:07:32.266484-07:00 zoot-vm1 rsyslogd-pstats: pstats:
processed=2184 failed=0
2014-05-04T19:07:32.266487-07:00 zoot-vm1 rsyslogd-pstats: pstats: size=0
enqueued=2184 full=0 discarded.full=0 discarded.nf=0 maxqsize=8
2014-05-04T19:07:32.266491-07:00 zoot-vm1 rsyslogd-pstats: main Q: size=3007
enqueued=7314 full=0 discarded.full=0 discarded.nf=0 maxqsize=3007
2014-05-04T19:08:32.326566-07:00 zoot-vm1 rsyslogd-pstats: imuxsock:
submitted=5122 ratelimit.discarded=0 ratelimit.numratelimiters=5073
2014-05-04T19:08:32.326577-07:00 zoot-vm1 rsyslogd-pstats: action 1:
processed=0 failed=0
2014-05-04T19:08:32.326580-07:00 zoot-vm1 rsyslogd-pstats: action 2:
processed=7315 failed=0
2014-05-04T19:08:32.326583-07:00 zoot-vm1 rsyslogd-pstats: action 3:
processed=7315 failed=0
2014-05-04T19:08:32.326586-07:00 zoot-vm1 rsyslogd-pstats: action 4:
processed=0 failed=0
2014-05-04T19:08:32.326588-07:00 zoot-vm1 rsyslogd-pstats: pstats:
processed=2192 failed=0
2014-05-04T19:08:32.326591-07:00 zoot-vm1 rsyslogd-pstats: pstats: size=0
enqueued=2192 full=0 discarded.full=0 discarded.nf=0 maxqsize=8
2014-05-04T19:08:32.326594-07:00 zoot-vm1 rsyslogd-pstats: main Q: size=7
enqueued=7322 full=0 discarded.full=0 discarded.nf=0 maxqsize=3008
Bill
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
