On Sat, 26 Mar 2016, Alec Swan wrote:
Hi there,I am using omelasticsearch module to send logs to elasticsearch server and started noticing the "fatal error on disk queue" error shown below. I also noticed a 560 byte .qi file created for the queue configured for omelasticsearch action as shown below. Once I removed the .qi file the error went away. Is there anything wrong with the configuration? If not, how do I go about troubleshooting this issue? CONFIGURATION action( type = "omelasticsearch" template = "es-payload" dynSearchIndex = "on" searchIndex = "logstash-index" searchType = "syslog" server = "127.0.0.1" serverport = "9200" uid = "xxx" pwd = "yyy" errorFile = "/var/log/rsyslog/ES-error.log" bulkmode = "on" action.resumeretrycount="-1" # retry if ES is unreachable (-1 for infinite retries) action.resumeInterval="60" queue.dequeuebatchsize="1000" # ES bulk size queue.type="linkedlist" queue.size="100000" queue.workerthreads="5" queue.timeoutworkerthreadshutdown="2000" queue.spoolDirectory="/var/spool/rsyslog" queue.filename="omelasticsearch-queue" queue.maxfilesize="100m" queue.maxdiskspace="1g" queue.highwatermark="80000" # when to start spilling to disk queue.lowwatermark="20000" # when to stop spilling to disk queue.saveonshutdown="on" ) ERROR Mar 27 04:02:04 m0058180 rsyslogd-2040: fatal error on disk queue 'action 4 queue[DA]', emergency switch to direct mode [v8.14.0 try http://www.rsyslog.com/e/2040 ] Mar 27 04:02:04 m0058180 rsyslogd: [origin software="rsyslogd" swVersion="8.14.0" x-pid="2648" x-info="http://www.rsyslog.com";] start Mar 27 04:02:04 m0058180 rsyslogd-2040: fatal error on disk queue 'action 2 queue[DA]', emergency switch to direct mode [v8.14.0 try http://www.rsyslog.com/e/2040 ]
usually this means that there is a permission problem (including SELinux permissions) when trying to access the files in the work directory.
David Lang _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
