Hello, Perhaps I wasn't clear on the first message but I am getting Segmentation fault.
this error was on syslog: Nov 24 20:18:25 ip-172-16-1-152 systemd[1]: rsyslog.service: main process exited, code=killed, status=11/SEGV and when I run it debug mode (-dn), it is trying to process the queue and gives the following error: ..... 9771.929711621:action 3 queue[DA]:Reg/w0: relp engine is dispatching frame with command 'rsp' 9771.929715606:action 3 queue[DA]:Reg/w0: in rsp command handler, txnr 201, code 200, text 'OK' 9771.929723831:action 3 queue[DA]:Reg/w0: DEL sess 0x7f21a40023b0 unacked 1, sessState 6 9771.929727757:action 3 queue[DA]:Reg/w0: in destructor: sendbuf 0x7f21a401de00 9771.929733344:action 3 queue[DA]:Reg/w0: relp engine is dispatching frame with command 'rsp' 9771.929739980:action 3 queue[DA]:Reg/w0: relpSessWaitState returns 10019 9771.929754387:action 3 queue[DA]:Reg/w0: in destructor: sendbuf 0x7f21a4025730 9771.929771799:action 3 queue[DA]:Reg/w0: relp engine created new client 0x7f21a40023b0 9771.929780641:action 3 queue[DA]:Reg/w0: omrelp: endTransaction Segmentation fault 8.4.2 is the latest version available as a package on Debian Jessie 8.6 and 8.16 if I use the backports. There are no repositories for Debian Jessie, only for Wheezy, are you suggesting to install 8.23 from source on a production server ? Kind Regards, Kosta On Fri, Nov 25, 2016 at 1:15 AM, Rainer Gerhards <rgerha...@hq.adiscon.com> wrote: > I don't see anything conrete either, but I would guess from context > that the queue got corrupted and on startup rsyslog may run into a > segfault. But no evidence for that. It is known that versions prior to > 8.22.0 sometimes had problems with corrupted disk queues. > > My suggestion is to delete the queue files and update to the curretn > 8.23.0 version. > > Rainer > > 2016-11-25 4:06 GMT+01:00 David Lang <da...@lang.hm>: > > it's no clear to me that rsyslog actually failed. It looks like systemd > saw > > the warning about ~ and decided to shut it down > > > > David Lang > > > > On Thu, 24 Nov 2016, Kosta Psimoulis wrote: > > > >> Date: Thu, 24 Nov 2016 20:36:47 -0500 > >> From: Kosta Psimoulis <kosta.psimou...@sourceknowledge.com> > >> Reply-To: rsyslog-users <rsyslog@lists.adiscon.com> > >> To: rsyslog@lists.adiscon.com > >> Subject: [rsyslog] rsyslog fails to start due to high queue > >> > >> > >> Hello, > >> > >> There was a misconfiguration for a remote forwarding server, the issue > was > >> fixed and the host was corrected by rsyslog is refusing to start with > the > >> following error: > >> > >> Rsyslog version: 8.4.2 > >> Distribution: Latest Debian Jessie Linux 8.6 > >> > >> -- Unit rsyslog.service has begun starting up. > >> Nov 24 20:18:32 ip-172-16-1-152 systemd[1]: rsyslog.service start > request > >> repeated too quickly, refusing to start. > >> Nov 24 20:18:32 ip-172-16-1-152 systemd[1]: Failed to start System > Logging > >> Service. > >> -- Subject: Unit rsyslog.service has failed > >> -- Defined-By: systemd > >> -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel > >> > >> Nov 24 20:18:26 ip-172-16-1-152 rsyslogd: [origin software="rsyslogd" > >> swVersion="8.4.2" x-pid="16534" x-info="http://www.rsyslog.com";] start > >> Nov 24 20:18:26 ip-172-16-1-152 rsyslogd-2307: warning: ~ action is > >> deprecated, consider using the 'stop' statement instead [try > >> http://www.rsyslog.com/e/2307 ] > >> Nov 24 20:18:25 ip-172-16-1-152 systemd[1]: rsyslog.service: main > process > >> exited, code=killed, status=11/SEGV > >> Nov 24 20:18:25 ip-172-16-1-152 systemd[1]: Unit rsyslog.service entered > >> failed state. > >> Nov 24 20:18:26 ip-172-16-1-152 systemd[1]: rsyslog.service holdoff time > >> over, scheduling restart. > >> Nov 24 20:18:26 ip-172-16-1-152 systemd[1]: Stopping System Logging > >> Service... > >> Nov 24 20:18:26 ip-172-16-1-152 systemd[1]: Starting System Logging > >> Service... > >> Nov 24 20:18:26 ip-172-16-1-152 systemd[1]: Started System Logging > >> Service. > >> Nov 24 20:18:26 ip-172-16-1-152 rsyslogd: [origin software="rsyslogd" > >> swVersion="8.4.2" x-pid="16540" x-info="http://www.rsyslog.com";] start > >> Nov 24 20:18:26 ip-172-16-1-152 rsyslogd-2307: warning: ~ action is > >> deprecated, consider using the 'stop' statement instead [try > >> http://www.rsyslog.com/e/2307 ] > >> > >> The warnings are fine, they are from aws cloudinit: > >> > >> My extra configuration file is: > >> $EscapeControlCharactersOnReceive off > >> $MaxMessageSize 64k > >> local6.info /efs/backup/i-XXXXXX/access-backup.log > >> local6.err /efs/backup/i-XXXXX/error-backup.log > >> module(load="omrelp") > >> local6.* action( > >> type="omrelp" > >> RebindInterval="200" > >> queue.FileName="apacheRule1" > >> queue.SaveOnShutdown="on" > >> queue.Type="LinkedList" > >> action.resumeRetryCount="-1" > >> target="XXXXXX.us-east-1.elb.amazonaws.com" port="20514" > >> ) > >> & stop > >> > >> > >> There are 13 files in /var/spool/rsyslog that won't process, here are > some > >> info: > >> > >> root@ip-172-16-1-152:/var/spool/rsyslog# cat apacheRule1.qi > >> <OPB:1:qqueue:1: > >> +iQueueSize:2:4:9959: > >> +tVars.disk.sizeOnDisk:2:8:13356962: > >>> > >>> End > >> > >> . > >> <Obj:1:strm:1: > >> +iCurrFNum:2:2:13: > >> +pszFName:1:11:apacheRule1: > >> +iMaxFiles:2:8:10000000: > >> +bDeleteOnClose:2:1:0: > >> +sType:2:1:1: > >> +tOperationsMode:2:1:2: > >> +tOpenMode:2:3:384: > >> +iCurrOffs:2:6:762769: > >> +inode:2:1:0: > >>> > >>> End > >> > >> . > >> <Obj:1:strm:1: > >> +iCurrFNum:2:1:1: > >> +pszFName:1:11:apacheRule1: > >> +iMaxFiles:2:8:10000000: > >> +bDeleteOnClose:2:1:1: > >> +sType:2:1:1: > >> +tOperationsMode:2:1:1: > >> +tOpenMode:2:3:384: > >> +iCurrOffs:2:5:20591: > >> +inode:2:6:414600: > >>> > >>> End > >> > >> . > >> Any hints of how I can fix this issue and prevent it from happening in > the > >> future ? > >> > >> Kind Regards, > >> Kosta > >> _______________________________________________ > >> rsyslog mailing list > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > >> http://www.rsyslog.com/professional-services/ > >> What's up with rsyslog? Follow https://twitter.com/rgerhards > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T > >> LIKE THAT. > >> > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of > > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > > LIKE THAT. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
