CentOS Linux release 7.3.1611 (Core)
rsyslog.x86_64 8.28.0-1.el7
@rsyslog_v8
rsyslog-mysql.x86_64 8.28.0-1.el7
@rsyslog_v8
This monhth, we have started to experience periordic DB write delays far in
excess of five (5) minutes!
During troubleshooting, I reviewed a delay thread I started here in
February 2016. That led me to problems associated with two recent threads I
started here this week.
Yes, we are using imjournal. Last year, it was suggested that that may be
source to our problems; but, I have not succeeded in DB writes without it.
Is this a likely solution to our problem? Last year, imjournal was not the
problem.
Among else, we have begun monitoring the journal:
/bin/journalctl -f -t rsyslogd
This morning I saw this entry:
Jul 21 02:13:07 hermes.provell.com rsyslogd[9585]: queue 'strm
0x7fa0a6231780', file '/var/lib/rsyslog/dbSftpQueue.00000001' opened for
non-append write, but already contains 14182 bytes [v8.28.0.master try
http://www.rsyslog.com/e/0 ]
In fact, that queue still contained data more than five hours later:
# ls -lrt /var/lib/rsyslog
total 24
-rw------- 1 root root 532 Jul 21 02:13 dbSftpQueue.qi
-rw------- 1 root root 14182 Jul 21 02:13 dbSftpQueue.00000001
-rw------- 1 root root 125 Jul 21 08:55 imjournal.state
# /bin/systemctl restart rsyslog
# ls -lrt /var/lib/rsyslog
total 4
-rw------- 1 root root 125 Jul 21 08:55 imjournal.state
Apparently, it required a restart of rsyslogd to flush that queue. On July
19, we rebooted this server several times (see other thread regarding NO
ssh logging;) after which over 100 events from July 17 finally flushed to
DB. To be clear, between the timestamps of those 7/17 events and afternoon
of 7/19 reboots, rsyslogd had been stopped/restarted more than ten times.
We are running impstats, if that is useful.
Please, advise. Thank you.
~ Mike
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
