I think this also applies to v5: http://blog.gerhards.net/2013/07/rsyslog-why-disk-assisted-queues-keep.html
Rainer 2016-02-17 9:53 GMT+01:00 nicolas <[email protected]>: > hi there, > i'm having trouble with queues spool files, > i'm using debian wheezy and rsyslog 5.8.11 from wheezy repo. > > here's my use case: > 1 machine 'rsyslog-server' > 1 machine 'rsyslog-client' > logs from rsyslog-client are being forwarded to rsyslog-server, using tcp > > > i tryed simulating connectivity problem by stopping rsyslog-server > (service rsyslog stop). > after doing that i saw queues files being created on the rsyslog-client > (so far so good, although i don't have *.qi file being created). > > say for example, i have: > /var/spool/rsyslog/remote.000001,2 and 3 files. > > finaly, i restart rsyslog service on 'rsyslog-server', > and then i notice all queues files but one are disappearing, > (queue being processed and sent to rsyslog-server). > > what i cannot understand is: why the remaing file is not being processed > and emptied ? > what happen to the queued logs that this file contains ? > why are they not sent to rsyslog-server and the file size put back to zero > or something like that? > i'm alway ending up with one last remaining queue file that is just > sitting there and is never processed > how can i tell rsyslog to finish processing the queue ? > > thanks. > > > here's my config: > rsyslog-client > ----------------- > > $WorkDirectory /var/spool/rsyslog > > # no throttling > $SystemLogRateLimitInterval 0 > $SystemLogRateLimitBurst 0 > $IMUXSockRateLimitInterval 0 > > # queue options > $MainMsgQueueSize 20000000 > $ActionQueueSize 10000000 > $ActionQueueType Disk > $ActionQueueFileName rlog > $ActionQueueMaxFileSize 5m > $ActionQueueMaxDiskSpace 40g > $ActionQueueTimeoutEnqueue 0 > $ActionResumeRetryCount -1 > $ActionResumeInterval 1 > $ActionQueueSaveOnShutdown on > > > # Forwarding only a few logs to rsyslog-server > *.*;auth,authpriv.none,local3.none @@rsyslog-server.net:1668 > kern.* @@rsyslog-server.net:1668 > > > > > > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
