On 10/19/2017 3:12 PM, Rainer Gerhards wrote:
Am 19.10.2017 21:55 schrieb "David Lang" <da...@lang.hm>:
RELP has it's place, but most of the time I'm willing to loose some logs
under rare failure conditions and so haven't bothered to use it.
large maxmessagesize leads to wasted memory in rsyslog, but nothing more
severe than that.
Thanks for confirming. I'll likely go ahead and increase that value to
128K to see if the problem goes away.
if your maxmessagesize was 64k, that should not have been a problem.
Acknowledged. Do you know if all inputs honor the global() maxmessagesize
value, or only certain ones? Does that value need to be specified using the
legacy configuration syntax?
That's really a question Rainer will need to answer
In theory "yes", if not, its a bug. I ironed out some of those bugs the
past releases, most notably in imfile. I won't outrule I have overlooked
some.
Rainer
It's far too soon to say that the issue with using RELP has been worked
around (other than using omfwd and imptcp in its place), but I modified
the imprelp input() definition on the receiver to explicitly specify
MaxDataSize="128k" instead of relying on the global parameter
configuration of maxMessageSize="128k".
That seems to have made a difference, but I won't know more until we go
a full day on Friday with heavy activity on the sending system again.
On a related note, I noticed that I enabled Keep Alive for the imrelp
input() definition. Does RELP benefit from enabling Keep Alive? If so,
do you specify it for both imrelp (input) and omrelp (action)?
I noticed that you can configure both ends of the connection when using
plain TCP forwarding (omfwd on sender and imptcp on receiver). Does RELP
not operate that way?
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
