thanks for the reply, but,
that page doesn't explain if the log queues contained in that file are
transfered on rsyslog-server.
that page just explain why you want to keep one spool file open.
ok fine, why not.. i'm concerned only about the logs.
if you tell me that even if the spool file size is greater than zero and
do contain log lines *but* they are all transfered in due time, provided
rsyslog-server is up, i'll be happy.
i was under the impression this wasn't the case though?
On 02/17/2016 03:25 PM, Rainer Gerhards wrote:
I think this also applies to v5:
http://blog.gerhards.net/2013/07/rsyslog-why-disk-assisted-queues-keep.html
Rainer
2016-02-17 9:53 GMT+01:00 nicolas <[email protected]>:
hi there,
i'm having trouble with queues spool files,
i'm using debian wheezy and rsyslog 5.8.11 from wheezy repo.
here's my use case:
1 machine 'rsyslog-server'
1 machine 'rsyslog-client'
logs from rsyslog-client are being forwarded to rsyslog-server, using tcp
i tryed simulating connectivity problem by stopping rsyslog-server
(service rsyslog stop).
after doing that i saw queues files being created on the rsyslog-client
(so far so good, although i don't have *.qi file being created).
say for example, i have:
/var/spool/rsyslog/remote.000001,2 and 3 files.
finaly, i restart rsyslog service on 'rsyslog-server',
and then i notice all queues files but one are disappearing,
(queue being processed and sent to rsyslog-server).
what i cannot understand is: why the remaing file is not being processed
and emptied ?
what happen to the queued logs that this file contains ?
why are they not sent to rsyslog-server and the file size put back to zero
or something like that?
i'm alway ending up with one last remaining queue file that is just
sitting there and is never processed
how can i tell rsyslog to finish processing the queue ?
thanks.
here's my config:
rsyslog-client
-----------------
$WorkDirectory /var/spool/rsyslog
# no throttling
$SystemLogRateLimitInterval 0
$SystemLogRateLimitBurst 0
$IMUXSockRateLimitInterval 0
# queue options
$MainMsgQueueSize 20000000
$ActionQueueSize 10000000
$ActionQueueType Disk
$ActionQueueFileName rlog
$ActionQueueMaxFileSize 5m
$ActionQueueMaxDiskSpace 40g
$ActionQueueTimeoutEnqueue 0
$ActionResumeRetryCount -1
$ActionResumeInterval 1
$ActionQueueSaveOnShutdown on
# Forwarding only a few logs to rsyslog-server
*.*;auth,authpriv.none,local3.none @@rsyslog-server.net:1668
kern.* @@rsyslog-server.net:1668
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
