On Mon, 13 Mar 2017, Wiebe Cazemier wrote:
From: "David Lang" <[email protected]>
No, there is no way for the sender to know that the receiver isn't processing
messages (that's why relp was invented)
Without RELP, how does a rsyslog client decide messages were sent off? Because
all clients were piling up their queues, so they must have known somehow.
it's ugly and there is a lot of queueing involved.
The client delivers the message to the TCP stack on the sending machine and
considers it sent. The OS on the sending machine allows a queue (how large
depends on the OS and various tuning configs), the sending machine tries to send
it over the network and allows for a given (also variable) amount of data to be
outstanding. The receiving machine acknowleges messages at the OS level and puts
them in the (again variable) buffer on the receiving machine. The rsyslog
instance on the receiving machine reads from this buffer and adds it to it's
queue.
When the receiving rsyslog doesn't have space to add the message to it's queue
(or if something goes wrong), it stops reading data from the receiving systems
buffer, when that buffer fills up the receiving system's OS stops sending acks
to the sending system. When the sending system has the max allowed outstanding
data waiting for acks on the network, it starts filling up it's sending buffers,
when those sending buffers fill up the sending rsyslog instance becomes unable
to deliver messages to the sending OS and starts to have them pile up in their
queues.
When the failure happens, our previous simple Nagios check which just checked
the TCP port never triggered, so the port itself worked.
that check just checks to see if the OS is working enough to accept a TCP
connection.
When I loose messages it's merely a bummer, but as long as they don't pile up
in queues.
If that's the case, you may want to switch to UDP. On a local network it's very
reliable (when you go through a bottleneck, say a wan link or firewall things
change), and doesn't have nearly as much buffering.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
