I found a link to recover queue index <https://gist.github.com/wilrnh/9373137> and started using that. That was a great help. My servers are sending to two central rsyslog servers. One is the Corporate server and the other is a server I manage to give me one location to monitor the log files. I have about 200 systems sending log files to this one server. All of the backed up queue files to the Corporate server were cleared up. On some of the systems, backed up queue files to my central server are still hanging around. I think it might relate to the $InputTCPMaxListeners and $InputTCPMaxSessions settings. This server is an HP DL380 G6 with 32GB of RAM and 2 quad core Intel Xeon X5570 CPUs. Is the maxsessions a total number, or the number per listener? I have max listeners set to 50 and sessions to 500. I'm thinking I probably need to increase the number of listeners. Also, on a few servers I have a file called "audit" that shows up in /var/spool/rsyslog. I have my audit daemon on each server writing to /var/audit. In this /var/spool/rsyslog/audit file, it points to /var/log/audit/audit.log. Not sure where it is coming from. Ideas?
Regards, Brad <https://gist.github.com/wilrnh/9373137> _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
