On Wed, 16 Mar 2016, Eugene Prokopiev wrote:
Hi,I have rsyslog with email, file and postgresql backend. Most significant part of my configuration is: module(load="impstats") module(load="imjournal") module(load="imudp") input(type="imudp" port="514") module(load="ommail") template (name="mail" type="string" string="Fake problem on %hostname%") template (name="mailbody" type="string" string="%rawmsg%") if $msg contains "fake" then { action(type="ommail" ... )} template(name="file" type="list") { ... } template(name="fileevent" type="list") { ... } *.* ?file;fileevent template(name="dbevent" type="list" option.stdsql="on") { ... } module(load="ompgsql") $WorkDirectory /var/spool/rsyslog $ActionQueueType LinkedList $ActionQueueFileName dbevent $ActionResumeRetryCount -1 *.* :ompgsql:127.0.0.1,eye,eye,;dbevent On starting rsyslog I see this messages: fatal error on disk queue 'action 2 queue[DA]', emergency switch to direct mode [v8.16.0 try http://www.rsyslog.com/e/2040 ] [origin software="rsyslogd" swVersion="8.16.0" x-pid="20321" x-info="http://www.rsyslog.com";] start action 0: origin=core.action processed=0 failed=0 suspended=0 suspended.duration=0 resumed=0 dynafile cache file: origin=omfile requests=11760 level0=10739 missed=470 evicted=460 maxused=10 closetimeouts=0 action 1: origin=core.action processed=11760 failed=0 suspended=0 suspended.duration=0 resumed=0 action 2: origin=core.action processed=11760 failed=0 suspended=0 suspended.duration=0 resumed=0 imudp(*:514): origin=imudp submitted=1583 resource-usage: origin=impstats utime=1285085 stime=590161 maxrss=63692 minflt=12798 majflt=0 inblock=16 oublock=6768 nvcsw=18094 nivcsw=1695 action 2 queue[DA]: origin=core.queue size=0 enqueued=0 full=0 discarded.full=0 discarded.nf=0 maxqsize=0 action 2 queue: origin=core.queue size=0 enqueued=11760 full=572 discarded.full=5 discarded.nf=0 maxqsize=1000 main Q: origin=core.queue size=8 enqueued=11768 full=0 discarded.full=0 discarded.nf=0 maxqsize=8807 imudp(w0): origin=imudp called.recvmmsg=3077 called.recvmsg=0 msgs.received=1583 First problem is 'fatal error on disk queue' message. I tried to read url from message, but there are no file name which can't be found in messages before this because this is first message. So, how to know which problem is occured and how to fix it?
This probably means that rsyslog doesn't have permissions to create files in the workdir, does this system have SELinux or AppArmor on it, they may not be allowing access to /var/spool/rsyslog
Next problem is actions/queues mapping in configuration and messages which was generated by impstats. What is 'queue[DA]'
you have provided a filename for the queue, so that it can use memory, but after the memory queue fills up, it will spill over to disk. DA stands for disk assist, it's the disk portion of the queue.
and why it has 0 in size and maxqsize params?
well, since it couldn't be created, it never had any messages put in it, so it's size is 0 and the max size it has ever been is -
Why I see discarded.full=5 in next message for unnnamed queue? Can I increase maxqsize for this and for main queue?
This queue was full 572 times and 5 times it threw away a message because it couldn't handle it.
When you start working with queues, it's really a good idea to switch over to the new style syntax. Among other things it lets you name things, so instead of 'action 2' which means the second output statement in the file, you can call it 'pg' or something like that.
unfortunantly, when you only have action # names, it becomes really critical to get the full config file, leaving something out will change which line we thing applies.
David Lang _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
