On 10/18/2017 3:22 PM, Rainer Gerhards wrote:
The queue errors are bad. Anything else in regard to that queue?
After discussing it on this thread, I stopped rsyslog yesterday and
moved all content from /var/spool/rsyslog to a different directory,
hoping to have rsyslog come back online with an empty queue. I was ready
to sacrifice the messages already queued at that point if I could just
get the box sending log messages in a stable manner to the receiver.
After some time, the queue began filling up again. As I noted earlier, I
updated the forward action to use omfwd instead of omrelp and the queue
cleared. Since I had good results with that change, I stopped rsyslog
and then moved back the files I had previously moved out of
/var/spool/rsyslog and started the daemon back up.
The queue quickly drained, but the remote receiver crashed a few times
in the process. Each time systemd would kick rsyslog and get it going again.
The thread messages are informational and part of the better status
indicators. They say that the load was so high an additional worker thread
was started... And later shut down as it was no longer needed.
Thank you for including the additional info in the new version. It's
nice to be able to spot at a glance when rsyslog finds itself under load.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
