First of all i'm ashamed to tell you what's coming :p
Don't blame me.
What do you think of the following workaround ?
My relp log flow :
ss -lap -o state established \( dport = :20514 \)
Fri Jul 24 13:50:25 2015
Recv-Q Send-Q Local Address:Port Peer Address:Port
0 0 10.17.252.4:46427 10.19.12.8:20514
users:(("haproxy",15625,2))
0 0 127.0.0.1:59709 127.0.0.1:20514
users:(("rsyslogd",26947,2))
0 22816 10.17.252.4:44953 10.19.12.9:20514
timer:(on,012ms,0) users:(("haproxy",15625,10))
1512 27160 127.0.0.1:59711 127.0.0.1:20514
timer:(on,204ms,0) users:(("rsyslogd",26947,10))
#/bin/bash
established=$(ss -lnp -o state established \( dport = :20514 \) not dst
127.0.0.1 | tail -n +2 | awk '{print $3}')
for socket in ${established};do
#echo "estab = ${socket}"
IFS=':' read -a socket_arr <<< "${socket}"
#echo "ip = ${socket_arr[0]}, port = ${socket_arr[1]}"
tcpkill -i eth0 host ${socket_arr[0]} and port ${socket_arr[1]} &
tcpkillpid=( ${tcpkillpid} $! )
done
sleep 2
kill "${tcpkillpid[@]}"
If the kill -HUP doesn't work, as it is relp protocole, i think i still have a
reliable log forwarding, right ?
Regards,
Smana
----- Mail original -----
De: [email protected]
À: "rsyslog-users" <[email protected]>
Envoyé: Vendredi 24 Juillet 2015 13:48:53
Objet: Re: [rsyslog] Load balancing issue
yes that was exactly what i was running :
while true; do
kill -HUP $(pgrep rsyslogd); sleep 5;
done&
watch 'ss -lap -o state established \( dport = :20514 \)'
Recv-Q Send-Q Local Address:Port Peer Address:Port
0 0 10.17.252.4:60445 10.19.12.5:20514
users:(("haproxy",15625,10))
0 6504 10.17.252.4:59126 10.19.12.9:20514
timer:(on,012ms,0) users:(("haproxy",15625,2))
0 48816 127.0.0.1:45659 127.0.0.1:20514
timer:(persist,192ms,0) users:(("rsyslogd",26947,2))
1760 5424 127.0.0.1:45651 127.0.0.1:20514
timer:(on,204ms,0) users:(("rsyslogd",26947,5))
After a few seconds (say 30), the destination hosts stay the same. After HUP.
Recv-Q Send-Q Local Address:Port Peer Address:Port
0 1432 10.17.252.4:60445 10.19.12.5:20514
timer:(on,176ms,0) users:(("haproxy",15625,10))
0 16296 10.17.252.4:59126 10.19.12.9:20514
timer:(on,012ms,0) users:(("haproxy",15625,2))
0 48816 127.0.0.1:45659 127.0.0.1:20514
timer:(persist,172ms,0) users:(("rsyslogd",26947,2))
672 21728 127.0.0.1:45651 127.0.0.1:20514
timer:(on,204ms,0) users:(("rsyslogd",26947,5))
Regards,
Smana
----- Mail original -----
De: "David Lang" <[email protected]>
À: "rsyslog-users" <[email protected]>
Envoyé: Vendredi 24 Juillet 2015 13:38:37
Objet: Re: [rsyslog] Load balancing issue
On Fri, 24 Jul 2015, [email protected] wrote:
> Hi David,
>
> Thank you again.
>
> I tried the workaround but the HUP signal doesn't close the outputs :
> * the source pid, source port, dest port stay the same even with a kill -HUP
> loop.
>
> In my logs i can see that the configuration is reread but the output's aren't
> closed.
> Jul 24 09:52:38 log-aggregator-itx2-1 rsyslogd: [origin software="rsyslogd"
> swVersion="8.10.0" x-pid="23317" x-info="http://www.rsyslog.com";] rsyslogd
> was HUPed
> Jul 24 09:52:43 log-aggregator-itx2-1 rsyslogd: [origin software="rsyslogd"
> swVersion="8.10.0" x-pid="23317" x-info="http://www.rsyslog.com";] rsyslogd
> was HUPed
> Jul 24 09:52:48 log-aggregator-itx2-1 rsyslogd: [origin software="rsyslogd"
> swVersion="8.10.0" x-pid="23317" x-info="http://www.rsyslog.com";] rsyslogd
> was HUPed
none of this data is supposed to chenage, where are you looking to say that the
source port is not changing?
do a netstat -an |grep ESTAB to show the established connections before and
after the HUP
David Lang
> Regards,
> Smana
>
>
> ----- Mail original -----
> De: "David Lang" <[email protected]>
> À: "rsyslog-users" <[email protected]>
> Envoyé: Jeudi 23 Juillet 2015 20:18:26
> Objet: Re: [rsyslog] Load balancing issue
>
> On Thu, 23 Jul 2015, [email protected] wrote:
>
>> So to resume there's 2 remaining issues i would like to address :
>>
>> * disabling octet count causes that my condition based on appname to be
>> ignored
>
> see my other message about fixing the format.
>
>> * i have a segfault when i enable rebindInterval
>
> this looks like a bug that's been reported and someone has been assigned to
> work onit. I'd suggest watching this bug and posting if alorbach has any
> trouble
> duplicating things
>
> https://github.com/rsyslog/rsyslog/issues/120
>
> In the meantime, as a poor-man's work-around, you can setup a script that
> does
> something like
>
> while true
> do
> killall -HUP rsyslogd
> sleep 10
> done
>
> this will send the HUP signal to rsyslog every 10 seconds, which will cause
> it
> to close it's outputs (the same thing the rebindinterval does every X
> messages)
>
> David Lang
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
> LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
> LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
