On 12/20/2016 11:09 PM, David Lang wrote:
On Tue, 20 Dec 2016, [email protected] wrote:
On 12/20/2016 1:38 AM, Benoit DOLEZ wrote:
Hi,
The ~40 messages are those of the window size : for performance
reason, a train of messages are sent and acked globally. To ack each
message independently you can try windowsize=1 with omrelp, but
sending message synchronously is a very bad idea. For omfwd, a tcp
window size is applied. With UDP, there is no ack, no window.
Regards
Benoit
Thanks for the reply. Am I correct in assuming then that I can expect
duplicate messages each time I restart the remote rsyslog receiver
instance?
If you are using RELP, any messages that the sender has not received a
confirmation of recipt for will be re-sent.
Fantastic, sounds like I'm good on that point then (I'm using RELP).
If you are using plain TCP, messages in flight will be lost
If you happened to have looked over the configs, did you see anything
that would result in the sending systems tossing old messages if the
remote rsyslog receiver stays down longer than "X" seconds?
Rsyslog has nothing that will throw away messages based on time. You can
set it to throw away messages if the queues get too full (look at the
high watermark settings)
you can also set the retries so that it will only attempt to deliver a
message X times before it gives up on that message.
Thanks for mentioning that. Is there a setting or command-line option
that you know of to dump all stock settings and current settings to the
screen/file? Something like 'postconf -d' or 'postconf' ?
Thanks for your help.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
