Hi,
I am trying to get my server to spool logs that has been cached to disk
after a restart but the logs does not seem to make their appearance on the
master server.
Here is my test methodology:
1. Stop networking on master rsyslog server
2. For loop on client server to create 40k of messages
3. Restart client server machine
4. Enable networking on rsyslog server
5. Wait for logs to appear, grow a beard...
The logs never make it to the master server the client config is as follows:
action( type="omrelp"
name="logtoserver"
target="192.168.8.134"
port="514"
queue.size="50000"
queue.type="LinkedList"
queue.spoolDirectory="/var/lib/rsyslog"
queue.filename="testforwardingqueue"
queue.lowwatermark="20000"
queue.highwatermark="35000"
queue.discardmark="50000"
queue.maxfilesize="1g"
queue.saveonshutdown="on"
action.reportSuspension="on"
action.reportSuspensionContinuation="on"
action.resumeInterval="10"
)
I do see the following in /var/log/messages:
2015-07-16T14:37:52.042791+01:00 rclient2 rsyslogd-2359: action
'logtoserver' resumed (module 'omrelp') [v8.11.0 try
http://www.rsyslog.com/e/2359 ]
2015-07-16T14:37:52.042830+01:00 rclient2 rsyslogd-2359: action
'logtoserver' resumed (module 'omrelp') [v8.11.0 try
http://www.rsyslog.com/e/2359 ]
However in pstats I am seeing:
2015-07-16T14:48:00.347526+01:00 rclient2 rsyslogd-pstats: logtoserver:
origin=core.action processed=1872 failed=0 suspended=2
suspended.duration=20 resumed=0
2015-07-16T14:48:00.347531+01:00 rclient2 rsyslogd-pstats: resource-usage:
origin=impstats utime=225596 stime=28747 maxrss=5012 minflt=1516 majflt=35
inblock=43928 oublock=784 nvcsw=551 nivcsw=247
So my question is why is these logs blocked? How/where could I get more
information about it, debug it?
I thought that the resumeInterval value would be short enough to prevent
falling into a too long back off period.
I am using CentOS 7 fully update with the latest rsyslog
rsyslog-relp-8.11.0-2.el7.x86_64
rsyslog-8.11.0-2.el7.x86_64
Regards
--
Gerhardus Geldenhuis
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
