As a side note, 8.18 (to be released April, 19th) will contain extra robustness measures against common .qi corruption cases.
Rainer 2016-04-14 13:21 GMT+02:00 Joe Blow <[email protected]>: > Tailing /var/log/messages when you restart rsyslog should tell you if the > disk backed queue was able to start up OK. If it wasn't, you'll get an error > something like "using in-memory queue, DA queue failed". > > If that's the case you still have qi file issues. > > One thing I would suggest is moving to the new syntax. What version are you > running for rsyslog? There's a much cleaner syntax with the newer action > stanzas. Also, turn on impstats so you can see exactly what is in the DA > queue as well as the memory queues (remember to name your action queues or > you're dealing with action numbers, which is a pain). > > I posted disk assisted configs to the mailing list a long time ago. They work > well, but when you have massive amounts of backlog data, you almost want a > separate rsyslog instance to empty those queues. > > Cheers, > > JB > > Original Message > From:[email protected] > Sent:April 14, 2016 3:58 AM > To:[email protected] > Reply-to:[email protected] > Subject:[rsyslog] recovering disk queue > > Hi, > On a system, rsyslog working directory got filled up by messages waiting to > be sent. > After restarting rsyslog, some messages were sent, but older messages were > still waiting. > I ran qi_recover.pl with the parameters below (we have two queues) but > nothing happened. > Is there a way to investigate why the messages are stuck and to ensure they > get delivered. > New messages are sent normally. > > [root@xxxxxx rsyslog]# /home/system/qi_recover.pl -w /var/spool/rsyslog/ -f > srvrfwd1 -d 8 > srvrfwd1.qi > traversing 82 files, please wait... > [root@ xxxxxx rsyslog]# ls -l srvrfwd1*|wc -l > 83 > [root@ xxxxxx rsyslog]# ls -l srvrfwd1*|wc -l > 83 > [root@ xxxxxx rsyslog]# /home/system/qi_recover.pl -w /var/spool/rsyslog/ -f > srvrfwd2 -d 8 > srvrfwd2.qi > traversing 1824 files, please wait... > [root@ xxxxxx rsyslog]# ls -l srvrfwd2*|wc -l > 1825 > > If it may be relevant, here is the content of one .qi file : > <OPB:1:qqueue:1: > +iQueueSize:2:6:103688: > +tVars.disk.bytesRead:2:1:0: > +tVars.disk.sizeOnDisk:2:8:85812877: >>End > . > <Obj:1:strm:1: > +tOperationsMode:2:1:4: > +iMaxFiles:2:8:10000000: > +bDeleteOnClose:2:1:0: > +pszFName:1:8:srvrfwd1: > +tOpenMode:2:3:384: > +iCurrFNum:2:4:1977: > +sType:2:1:1: > +iCurrOffs:2:6:774432: >>End > . > <Obj:1:strm:1: > +tOperationsMode:2:1:1: > +iMaxFiles:2:8:10000000: > +bDeleteOnClose:2:1:1: > +pszFName:1:8:srvrfwd1: > +tOpenMode:2:3:384: > +iCurrFNum:2:4:1896: > +sType:2:1:1: > +iCurrOffs:2:1:0: >>End > . > > > And the queue definition : > $ActionQueueType LinkedList # use asynchronous processing > $ActionQueueFileName srvrfwd1 # set file name, also enables disk mode > $ActionResumeRetryCount -1 # infinite retries on insert failure > $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down > $ActionQueueMaxDiskSpace 2g # 2gb space limit (use as much as possible) > *.info;authpriv.*;auth.*;mail.none;cron.none @@xxxxx:5140 > > Is there general guidelines on how to set up disk-assisted queues and test > they actually work ? > > Regards > Philippe > > !!!************************************************************************************* > "Ce message et les pi?ces jointes sont confidentiels et r?serv?s ? l'usage > exclusif de ses destinataires. Il peut ?galement ?tre prot?g? par le secret > professionnel. Si vous recevez ce message par erreur, merci d'en avertir > imm?diatement l'exp?diteur et de le d?truire. L'int?grit? du message ne > pouvant ?tre assur?e sur Internet, la responsabilit? de Worldline ne pourra > ?tre recherch?e quant au contenu de ce message. Bien que les meilleurs > efforts soient faits pour maintenir cette transmission exempte de tout virus, > l'exp?diteur ne donne aucune garantie ? cet ?gard et sa responsabilit? ne > saurait ?tre recherch?e pour tout dommage r?sultant d'un virus transmis. > > This e-mail and the documents attached are confidential and intended solely > for the addressee; it may also be privileged. If you receive this e-mail in > error, please notify the sender immediately and destroy it. As its integrity > cannot be secured on the Internet, the Worldline liability cannot be > triggered for the message content. Although the sender endeavours to maintain > a computer virus-free network, the sender does not warrant that this > transmission is virus-free and will not be liable for any damages resulting > from any virus transmitted.!!!" > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
