Hi there,
I am using omelasticsearch module to send logs to elasticsearch server and
started noticing the "fatal error on disk queue" error shown below. I also
noticed a 560 byte .qi file created for the queue configured for
omelasticsearch action as shown below. Once I removed the .qi file the
error went away.
Is there anything wrong with the configuration? If not, how do I go about
troubleshooting this issue?
CONFIGURATION
action(
type = "omelasticsearch"
template = "es-payload"
dynSearchIndex = "on"
searchIndex = "logstash-index"
searchType = "syslog"
server = "127.0.0.1"
serverport = "9200"
uid = "xxx"
pwd = "yyy"
errorFile = "/var/log/rsyslog/ES-error.log"
bulkmode = "on"
action.resumeretrycount="-1" # retry if ES is unreachable (-1 for
infinite retries)
action.resumeInterval="60"
queue.dequeuebatchsize="1000" # ES bulk size
queue.type="linkedlist"
queue.size="100000"
queue.workerthreads="5"
queue.timeoutworkerthreadshutdown="2000"
queue.spoolDirectory="/var/spool/rsyslog"
queue.filename="omelasticsearch-queue"
queue.maxfilesize="100m"
queue.maxdiskspace="1g"
queue.highwatermark="80000" # when to start spilling to disk
queue.lowwatermark="20000" # when to stop spilling to disk
queue.saveonshutdown="on"
)
ERROR
Mar 27 04:02:04 m0058180 rsyslogd-2040: fatal error on disk queue 'action 4
queue[DA]', emergency switch to direct mode [v8.14.0 try
http://www.rsyslog.com/e/2040 ]
Mar 27 04:02:04 m0058180 rsyslogd: [origin software="rsyslogd"
swVersion="8.14.0" x-pid="2648" x-info="http://www.rsyslog.com";] start
Mar 27 04:02:04 m0058180 rsyslogd-2040: fatal error on disk queue 'action 2
queue[DA]', emergency switch to direct mode [v8.14.0 try
http://www.rsyslog.com/e/2040 ]
Thanks,
Alec
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
