Hi Nicolas, Unfortunately, I'm not aware of any specific issue here. But there are some options regarding discarding messages when the queue exceeds a certain size (look for DiscardMark and DiscardSeverity): http://www.rsyslog.com/doc/v5-stable/configuration/action/index.html#action-queue-specific-configuration-statements
Maybe you can find a workaround that way (I assume you can discard everything after you hit a certain limit). Best regards, Radu -- Performance Monitoring * Log Analytics * Search Analytics Solr & Elasticsearch Support * http://sematext.com/ On Tue, Jun 30, 2015 at 12:32 PM, Nicolas Guyomar <[email protected] > wrote: > Hi, > > Upgrade to V8 is planned for this year, but in the meantime I thought I > could find a way to maybe discard messages when rsyslog has no more space > left in its work directory (which see. > Losing some messages during burst period is acceptable for us, but being > forced to manually delete and restart is more complicated. > > I hoped the problem was some sort of misconfiguration on my side, or maybe > a know issue using omrelp with logstash relp input. > > > > > On 30 June 2015 at 09:55, Radu Gheorghe <[email protected]> > wrote: > > > Hi Nicolas, > > > > I have some vague memories about nasty bugs in disk-assisted queues that > > were fixed in the last few years. RELP modules surely have changed as > well. > > Can you try with the latest stable (8.10 I think) and see if it helps? > Even > > if it doesn't, I'm pretty sure the fix will come in the 8.x branch > because > > it sounds pretty serious. > > > > Best regards, > > Radu > > > > -- > > Performance Monitoring * Log Analytics * Search Analytics > > Solr & Elasticsearch Support * http://sematext.com/ > > > > On Tue, Jun 30, 2015 at 10:42 AM, Nicolas Guyomar < > > [email protected] > > > wrote: > > > > > Hi All, > > > > > > I've got a simple question on disk assisted queue behaviour, it could > be > > > trivial, but I can't find an answer on the internet. > > > > > > I'm using rsyslog V5 to forward nginx access log to some logstash > > instances > > > using omrelp > > > > > > Sometimes, because of activity burst, rsyslog flush onto disk 200 1Mo > > files > > > (which is the expected behaviour), but then stays stuck, no more > messages > > > are sent to logstash. > > > I have to delete state files as well as queue files so that rsyslog > start > > > sending messages to logstash again. > > > Restarting rsyslog without deleting those files has no effect. > > > > > > Here is my rsyslog config in case I missed something > > > > > > $RuleSet nginxRuleSet > > > $RulesetCreateMainQueue on > > > > > > $WorkDirectory /tmp > > > $ActionQueueFileName queue-nginx > > > $ActionQueueMaxDiskSpace 200m > > > $ActionQueueSaveOnShutdown on > > > $ActionQueueType LinkedList > > > $ActionQueueSize 540000 > > > $ActionResumeRetryCount -1 > > > *.* :omrelp:<%= @lblog %>:5001;erableTmpl > > > & ~ > > > > > > > > > $InputUDPServerBindRuleset nginxRuleSet > > > $UDPServerRun 515 > > > > > > Is it a known behaviour ? > > > > > > Thank you for any help one could provide > > > > > > Nicolas > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com/professional-services/ > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > myriad > > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > > DON'T LIKE THAT. > > > > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
