Hi David, We see Rsyslog starting to use a lot of memory when it cannot send data to Elasticsearch. We expected to see logs written to disk, but instead found a message on startup that looked like this:
> fatal error on disk queue 'main_nojson queue[DA]', emergency switch to > direct mode [v8.11.0 try http://www.rsyslog.com/e/2040 ] Permissions were correct on the queue files. Thanks, Ciprian -- Monitoring * Alerting * Anomaly Detection * Centralized Log Management Solr & Elasticsearch Support * http://sematext.com/ On Fri, Aug 21, 2015 at 12:34 PM, David Lang <[email protected]> wrote: > On Fri, 21 Aug 2015, Otis Gospodnetić wrote: > > Hi, >> >> Are there known situations where rsyslog disk queues can get corrupt? >> >> Sorry for such a high-level and open question, but we sometimes see disk >> queue corruption and I wanted to see if anyone else sees that in certain >> situation (e.g. when rsyslog is under pressure, when it is stopped in a >> certain way, when it runs out of memory, or something along these lines)? >> > > Well, if it crashes as it's writing data, or if it's trying to flush the > queue to disk on shutdown and gets killed by -9 while it's doing so I would > expect problems (some distros send a kill -15, wait a bit and then do kill > -9, if there's too much work to do in writing the memory queue to disk, > rsyslog will be caught by this) > > Other than that, nothing specific to disk queues. > > what sort of corruption are you seeing? > > David Lang > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
