Hi, Upgrade to V8 is planned for this year, but in the meantime I thought I could find a way to maybe discard messages when rsyslog has no more space left in its work directory (which see. Losing some messages during burst period is acceptable for us, but being forced to manually delete and restart is more complicated.
I hoped the problem was some sort of misconfiguration on my side, or maybe a know issue using omrelp with logstash relp input. On 30 June 2015 at 09:55, Radu Gheorghe <[email protected]> wrote: > Hi Nicolas, > > I have some vague memories about nasty bugs in disk-assisted queues that > were fixed in the last few years. RELP modules surely have changed as well. > Can you try with the latest stable (8.10 I think) and see if it helps? Even > if it doesn't, I'm pretty sure the fix will come in the 8.x branch because > it sounds pretty serious. > > Best regards, > Radu > > -- > Performance Monitoring * Log Analytics * Search Analytics > Solr & Elasticsearch Support * http://sematext.com/ > > On Tue, Jun 30, 2015 at 10:42 AM, Nicolas Guyomar < > [email protected] > > wrote: > > > Hi All, > > > > I've got a simple question on disk assisted queue behaviour, it could be > > trivial, but I can't find an answer on the internet. > > > > I'm using rsyslog V5 to forward nginx access log to some logstash > instances > > using omrelp > > > > Sometimes, because of activity burst, rsyslog flush onto disk 200 1Mo > files > > (which is the expected behaviour), but then stays stuck, no more messages > > are sent to logstash. > > I have to delete state files as well as queue files so that rsyslog start > > sending messages to logstash again. > > Restarting rsyslog without deleting those files has no effect. > > > > Here is my rsyslog config in case I missed something > > > > $RuleSet nginxRuleSet > > $RulesetCreateMainQueue on > > > > $WorkDirectory /tmp > > $ActionQueueFileName queue-nginx > > $ActionQueueMaxDiskSpace 200m > > $ActionQueueSaveOnShutdown on > > $ActionQueueType LinkedList > > $ActionQueueSize 540000 > > $ActionResumeRetryCount -1 > > *.* :omrelp:<%= @lblog %>:5001;erableTmpl > > & ~ > > > > > > $InputUDPServerBindRuleset nginxRuleSet > > $UDPServerRun 515 > > > > Is it a known behaviour ? > > > > Thank you for any help one could provide > > > > Nicolas > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
