2014-10-17 18:22 GMT+02:00 Michael Hart <[email protected]>:
> I'm running rsyslog 8.4.2 on ubuntu 12.04 (freshly compiled). I'm losing
> the first log line after a tcp connection is reset, and can replicate it
> with these steps. The same config with version 7.4.5 worked flawlessly:
>
You were simply lucky in 7.4.5. See here:
www.rsyslog.com/doc/v8-stable/configuration/modules/omfwd.html
under "
*ResendLastMSGOnReconnect" and be sure to follow the links quoted there.*
*A short answer is that you may want to use RELP to avoid this
problem.Rainer*
>
> Test case:
>
> * rsyslogd 8.4.2 running with omfwd configured to send to
> localhost:5544 over tcp.
> * netcat listening to port 5544 (nc -l 5544)
> * start rsyslogd
> * send message. Successfully sent, netcat displays it.
> * stop netcat.
> * netcat sends a FIN, rsyslog ACK's it. Connection goes into
> CLOSE_WAIT state forever (well until I send another message and force
> rsyslog to reconnect, but > 10 minutes if I wait)
> * start netcat.
> * send another message.
> * rsyslog sends a FIN packet, netcat acks. Then rsyslog builds the
> TCP connection but sends nothing. Message is lost forever.
> * send another message, goes through successfully (as does every
> subsequent message)
>
> The output from rsyslogd in debug mode shows this sequence of events
> (customerstreamserver is the name of my action)
> 1858.496126807:customerstreamserver queue:Reg/w0: omfwd: add 224 bytes to
> send buffer (curr offs 0)
> 1858.496130718:customerstreamserver queue:Reg/w0: omfwd: endTransaction,
> offsSndBuf 224, iRet -2121
> 1858.496137143:customerstreamserver queue:Reg/w0: CheckConnection detected
> broken connection - closing it
> 1858.496287716:customerstreamserver queue:Reg/w0: TCPSendBuf error -2027,
> destruct TCP Connection!
> 1858.496300567:customerstreamserver queue:Reg/w0: file netstrms.c released
> module 'lmnsd_ptcp', reference count now 2
> 1858.496305316:customerstreamserver queue:Reg/w0: Action 16 transitioned
> to state: rtry
> 1858.496312020:customerstreamserver queue:Reg/w0: actionDoRetry:
> customerstreamserver enter loop, iRetries=0
> 1858.496315931:customerstreamserver queue:Reg/w0: DDDD: tryResume:
> pWrkrData 0x7f83fc0022b0
> 1858.496319563:customerstreamserver queue:Reg/w0: localhost
> 1858.496323753:customerstreamserver queue:Reg/w0: TCPSendInit CREATE
> 1858.496329620:customerstreamserver queue:Reg/w0: source file netstrms.c
> requested reference for module 'lmnsd_ptcp', reference count now 3
> 1858.496668479:customerstreamserver queue:Reg/w0: actionDoRetry:
> customerstreamserver action->tryResume returned 0
> 1858.496673786:customerstreamserver queue:Reg/w0: actionDoRetry:
> customerstreamserver had success RDY again (iRet=0)
> 1858.496684123:customerstreamserver queue:Reg/w0: Called LogMsg, msg:
> action 'customerstreamserver' resumed (module 'builtin:omfwd')
> 1858.496695017:customerstreamserver queue:Reg/w0: main Q: qqueueAdd: entry
> added, size now log 1, phys 1 entries
>
> Config for the action is as follows:
>
> ruleset(name="customerstreamserver") {
> #ignore template stuff
> action(type="omfwd"
> name="customerstreamserver"
> target="localhost"
> port="5544"
> protocol="tcp"
> template="LongTagForwardFormat"
> queue.filename="customerstreamserver"
> queue.maxdiskspace="2147483648"
> queue.saveonshutdown="on"
> queue.type="LinkedList"
> queue.size="4000000"
> queue.highwatermark="1000000"
> queue.lowwatermark="900000"
> queue.discardmark="3600000"
> queue.discardseverity="4"
> queue.timeoutenqueue="0"
> action.resumeretrycount="-1"
> action.resumeinterval="1"
> action.reportSuspension="on"
> action.reportSuspensionContinuation="on"
> )
> stop
> }
> input(type="imudp" port="1514" ruleset="customerstreamserver")
> input(type="imtcp" port="1514" ruleset="customerstreamserver")
>
> Any ideas?
>
> Thanks
> mike
> --
> Michael Hart
> Arctic Wolf Networks
> M: 226-388-4773
>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> DON'T LIKE THAT.
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
