David, so, this all looks like a bug in rsyslog to me.
Before filing one I wanted to be sure that I'm not having misconfigured anything. Is the configuration snippet I posted correct? Would be great to have a second opinion before I go on filing a bug report. Michael 2014-06-18 18:00 GMT+02:00 Michael Biebl <[email protected]>: > 2014-06-18 17:34 GMT+02:00 David Lang <[email protected]>: >> the files should only be created as neeeded (at least, that's the newest >> behavior, the old syntax may trigger different behavior) > > > I tried with the attached sample config. No server was listening on > localhost:20514 > Then logged a few messages via "logger". Then stopped rsyslog. > At this point no message was transferred (as no server was receiving them). > > So, I would expect that rsyslog spools those messages to disk on shutdown > (with > queue.saveonshutdown="on") > > > > >> >> David Lang >> >> >> >> On Wed, 18 Jun 2014, Michael Biebl wrote: >> >>> Date: Wed, 18 Jun 2014 16:56:18 +0200 >>> From: Michael Biebl <[email protected]> >>> Reply-To: rsyslog-users <[email protected]> >>> To: rsyslog-users <[email protected]> >>> Subject: [rsyslog] queue files not written when using action() syntax (and >>> omrelp) >>> >>> >>> Hi, >>> >>> an interesting issue was raised today. >>> rsyslog does not create any queue files when using the new style action >>> syntax. >>> >>> See the attached example rsyslog.conf. If I use the old-style syntax, >>> the queue files are creatd in /var/spool/rsyslog. >>> If I use the new-style action() syntax, no queue files are created. >>> >>> Running rsyslog in debug mode with the new-style syntax, it seems to >>> parse the parameters correctly (see attached log). >>> >>> Am I missing something or is this simply a bug in rsyslog? >>> >>> I've tested the attached config with both 7.6.3 and 8.2.2. >>> >>> >>> >>> >>> Cheers, >>> Michael >>> >>> >>> # rsyslog.conf >>> >>> module(load="imuxsock") # provides support for local system logging >>> module(load="omrelp") >>> $WorkDirectory /var/spool/rsyslog >>> >>> >>> # using old-style syntax works >>> #$ActionQueueType LinkedList >>> #$ActionQueueFileName test.legacy >>> #$ActionResumeRetryCount -1 >>> #$ActionQueueSaveOnShutdown on >>> #$ActionQueueDiscardMark 90000 >>> #$ActionQueueSize 100000 >>> #*.* :omrelp:localhost:20514;RSYSLOG_TraditionalFileFormat >>> >>> # this one doesn't create any queue files >>> *.* action(type="omrelp" target="localhost" port="20514" >>> template="RSYSLOG_TraditionalFileFormat" queue.type="LinkedList" >>> queue.size="100000" queue.filename="test.new" >>> queue.saveonshutdown="on" queue.discardmark="90000" >>> queue.highwatermark="1" queue.syncqueuefiles="on") >>> >> >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of >> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T >> LIKE THAT. >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of >> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T >> LIKE THAT. > > > > -- > Why is it that all of the instruments seeking intelligent life in the > universe are pointed away from Earth? -- Why is it that all of the instruments seeking intelligent life in the universe are pointed away from Earth? _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
