On Tue, 2 Jun 2015, Muhammad Asif wrote:
Is there any default queue mechanism in rsyslog. I did not configure any
main and action queue but when i checked imstat statistics. It shows the
following output.
Yes, there is a default main queue in rsyslog. In this case it shows that you
are keeping up.
Tue Jun 2 17:30:17 2015: main Q: size=0 enqueued=60933 full=0
discarded.full=0 discarded.nf=0 maxqsize=409
Tue Jun 2 17:31:17 2015: imuxsock: submitted=4 ratelimit.discarded=0
ratelimit.numratelimiters=3
Tue Jun 2 17:31:17 2015: action 1: processed=60933 failed=0
Tue Jun 2 17:31:17 2015: action 2: processed=0 failed=0
Tue Jun 2 17:31:17 2015: action 3: processed=20 failed=0
Tue Jun 2 17:31:17 2015: action 4: processed=60913 failed=0
Tue Jun 2 17:31:17 2015: action 5: processed=0 failed=0
Tue Jun 2 17:31:17 2015: action 6: processed=0 failed=0
Tue Jun 2 17:31:17 2015: action 7: processed=0 failed=0
Tue Jun 2 17:31:17 2015: action 8: processed=0 failed=0
Tue Jun 2 17:31:17 2015: action 9: processed=0 failed=0
Tue Jun 2 17:31:17 2015: action 10: processed=0 failed=0
Tue Jun 2 17:31:17 2015: action 11: processed=0 failed=0
*Tue Jun 2 17:31:17 2015: action 12: processed=60932 failed=60932*
Tue Jun 2 17:31:17 2015: action 13: processed=60933 failed=0
Tue Jun 2 17:31:17 2015: imudp(*:514): submitted=0
Tue Jun 2 17:31:17 2015: imudp(*:514): submitted=0
Tue Jun 2 17:31:17 2015: imtcp(514): submitted=0
Tue Jun 2 17:31:17 2015: main Q: size=0 enqueued=60933 full=0
discarded.full=0 discarded.nf=0 maxqsize=409
Why it is showing as many failed messages as many processed.
because that action (whatever it is) is failing to deliver messages. We'd need
to see the configuration to know what this is.
Can we use rsyslog in place of logstash.
yes.
that being said, we have no idea what you are trying to do yet without seeing
the config.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
