> > size is how many items are in the queue at the time it reports the data, > Since this is just after pstats adds all it's logs to the queue, this is > going to start at the number of items pstats reports and go up if there are > more messages pending. >
I see, sounds like that's what I'm looking for. you can add a name= field in an action() statement and that name will be > reported instead of the action number. with even a few of these you can > identify the other actions relative to the named ones. Perfect! This is missing a lot of fields that I'm used to seeing, how old a version > of rsyslog are you using? I'm on 7.4.4, the version that ships with Ubuntu 14.04. I recognize that I could upgrade to the newer package, but I'm trying to work with and test on the version we're using in production, which can't be upgraded as easily. Basically, I'm trying to reproduce the failure case of what happens when a central rsyslog server starts backing up, causing the clients shipping to it to queue, causing local writes to block and slow down the application. we would need to know the version and see the config to be able to help > much. Thanks, that helps a lot already actually. On Tue, Apr 5, 2016 at 9:41 PM, David Lang <[email protected]> wrote: > On Tue, 5 Apr 2016, Daniel Ellis wrote: > > Hi all, >> >> I have a few questions about the impstats module, the output it's >> generating, and queues in general. >> >> I'm seeing this in my stats output: >> >> Apr 6 03:44:44 rsyslog-client rsyslogd-pstats: main Q: size=15 >> >>> enqueued=202 full=0 discarded.full=0 discarded.nf=0 maxqsize=16 >>> >>> >> This post <http://www.rsyslog.com/how-to-use-impstats/> explains most of >> the fields, but what exactly is "size". As I understand it, the default >> main message queue size is 10,000. I've also tried explicitly setting >> this, but the "size" output still says 15. >> > > size is how many items are in the queue at the time it reports the data, > Since this is just after pstats adds all it's logs to the queue, this is > going to start at the number of items pstats reports and go up if there are > more messages pending. > > My goal here was to test queueing as well as whether I would be able to >> monitor the queues on the sender if they got too large. I tried an >> experiment where I turned off the receiving server (receiving via relp). >> Here was the pstats output before turning off the server: >> >> Apr 6 03:48:44 rsyslog-client rsyslogd-pstats: imuxsock: submitted=106 >> ratelimit.discarded=0 ratelimit.numratelimiter >> s=102 >> Apr 6 03:48:44 rsyslog-client rsyslogd-pstats: action 1: processed=0 >> failed=0 >> > > This is missing a lot of fields that I'm used to seeing, how old a version > of rsyslog are you using? > > >> >> I assumed that the purpose of the queue was to allow messages to back up >> in >> the case of unforeseen connectivity issues, but in this case, all of the >> messages appear to just have dropped, and the maxqsize hasn't incremented >> at all. Is my understanding fundamentally wrong here? >> > > what is your retry setting? by default it's 0 so it doesn't retry > > Additionally, is it possible to identify *which* action is associated with >> an action number? In this case, I originally thought my relp action was >> #5 until I tried the failure scenario and saw it was actually #14. >> > > you can add a name= field in an action() statement and that name will be > reported instead of the action number. with even a few of these you can > identify the other actions relative to the named ones. > > Thanks for any help anyone can offer. >> > > we would need to know the version and see the config to be able to help > much. > > David Lang > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
