2017-03-08 18:16 GMT+01:00 Alec Swan <[email protected]>: > David, I double checked and all my actions with type="omelasticsearch" > have different name settings. However, all queue file names have > omelasticsearch-queue.xxx > format. Shouldn't queue files be named using omelasticsearch action name > instead of just type? >
It's not the type or whatever ... you specifiy the name, as done here: queue.filename="omelasticsearch-queue" Unfortunately, rsyslog does currently not detect that you reuse the same name, and doing so will definitely result in queue corruption. So this probably is the culprit. Newer versions at least report that something went wrong when it finally happens (and it will!). > > Rainer, I will give 8.25.0 a try and see if it fixes the issue. BTW, is it > the responsibility of each output plugin, such as omelasticsearch, to > enforce maxdiskspace requirement or is it built in the generic queue > management code? > That's generic code, the plugin doesn't even know what kind of queue is used. Rainer > > Thanks, > > Alec > > On Wed, Mar 8, 2017 at 12:38 AM, Rainer Gerhards <[email protected] > > wrote: > >> This may be caused by a previous queue corruption, which left over some >> (unused) queue files. That happened especially with versions prior to >> 8.24.0 (8.25 is still preferrable, as it contains more queue robustness >> improvements). >> >> Rainer >> >> 2017-03-08 0:51 GMT+01:00 David Lang <[email protected]>: >> >>> On Tue, 7 Mar 2017, Alec Swan via rsyslog wrote: >>> >>> Hello, >>>> >>>> I noticed that rsyslog wrote over 8GB in omelasticsearch-queue.xxx files >>>> (each file is 101MB in size) when Elasticsearch server was down even >>>> though >>>> I have queue.maxdiskspace="1g" setting on the two omelasticsearch >>>> actions I >>>> am using (see below). Am I missing some other setting or is this a bug? >>>> >>> >>> you should not have multiple actions with the same name, and multiple >>> action queues using the same queue.filename is sure to cause grief. >>> >>> if only one action is using the name and it created more than 10 100M >>> files, that is a bug. >>> >>> David Lang >>> >>> >>> >>>> action( >>>> type = "omelasticsearch" >>>> name = "omelasticsearch.log" >>>> template = "es-payload" >>>> dynSearchIndex = "on" >>>> searchIndex = "logstash-index" >>>> searchType = "http-request" >>>> server = "myserver" >>>> serverport = "9200" >>>> usehttps = "on" >>>> uid = "user" >>>> pwd = "pass" >>>> bulkmode = "on" >>>> action.resumeretrycount="-1" # retry if ES is unreachable (-1 >>>> for >>>> infinite retries) >>>> action.resumeInterval="60" >>>> queue.dequeuebatchsize="1000" # ES bulk size >>>> queue.type="linkedlist" >>>> queue.size="100000" >>>> queue.workerthreads="1" >>>> queue.timeoutworkerthreadshutdown="2000" >>>> queue.spoolDirectory="/var/spool/rsyslog" >>>> queue.filename="omelasticsearch-queue" >>>> queue.maxfilesize="100m" >>>> queue.maxdiskspace="1g" >>>> queue.highwatermark="80000" # when to start spilling to disk >>>> queue.lowwatermark="20000" # when to stop spilling to disk >>>> queue.saveonshutdown="on" >>>> queue.timeoutenqueue="0" >>>> ) >>>> Thanks, >>>> >>>> Alec >>>> _______________________________________________ >>>> rsyslog mailing list >>>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>>> http://www.rsyslog.com/professional-services/ >>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a >>>> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if >>>> you DON'T LIKE THAT. >>>> >>>> _______________________________________________ >>> rsyslog mailing list >>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>> http://www.rsyslog.com/professional-services/ >>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>> DON'T LIKE THAT. >>> >> >> > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
