On Sat, 8 Jul 2017, deoren wrote:
Looking around I learned of these two directives:
$DebugLevel 2
$DebugFile /var/log/rsyslog-debug.log
I added those, rebooted the VM and quickly had lots of debug info to work
with. In the file I found these entries:
5676.682567045:sendToLogserver queue:Reg/w0: error 111 in getaddrinfo
5676.682583062:sendToLogserver queue:Reg/w0: end relpSessConnect, iRet 10014
5676.682588226:sendToLogserver queue:Reg/w0: Action 1 transitioned to state:
rtry
5676.682594836:sendToLogserver queue:Reg/w0: action 'sendToLogserver': is
transactional - executing in commit phase
5676.682597400:sendToLogserver queue:Reg/w0: actionDoRetry: sendToLogserver
enter loop, iRetries=0, ResumeInRow 1
5676.682684496:sendToLogserver queue:Reg/w0: error 111 in getaddrinfo
5676.682688779:sendToLogserver queue:Reg/w0: end relpSessConnect, iRet 10014
5676.682691652:sendToLogserver queue:Reg/w0: actionDoRetry: sendToLogserver
action->tryResume returned -2007
5676.682693866:sendToLogserver queue:Reg/w0: actionDoRetry: sendToLogserver
check for max retries, iResumeRetryCount -1, iRetries 0
I believe that getaddrinfo is attempting to lookup the IP for the given FQDN,
but it's failing with whatever error 111 is. Looking at the counts given by
way of the impstats module, it appears that the queue is only growing and
even if the system appears to be fully functional and other daemons are
accessing the network without issue, rsyslog still refuses to send messages
to the remote system.
If rsyslog is unable to resolve the name, it cannot send the message. I always
put the log destinations in /etc/hosts or configure it to send to an IP address.
rsyslog will suspend sending logs when the attempt to connect fails, and will
only retry periodically (with a back-off to keep from probing too frequently as
the probes themselves can be a problem)
we've had other people report that the backoff gets unreasonably long, we should
put in a limit to how long it will wait.
In your debug logs, look for the initial suspend message, it should say when it
will try again (you can also configure rsyslog to log suspends and resumes as
well)
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
