Upon further investigation it appears this only happens when a queue is
configured for the action. It sounds like a bug that was previously fixed
after 8.10 (https://github.com/rsyslog/rsyslog/issues/375), has there
perhaps been a regression in this area?
Regards,
Nic
On 08 February 2018 at 10:20:27, Nicholas von Waltsleben (
nicholas.vonwaltsle...@voss-solutions.com) wrote:
Hi
I seem to be running into an issue with rsyslog 8.32.0 running on Ubuntu
14.04. I have actions configured to fire when the previous action is
suspended, and was working fine with the version included with Ubuntu
(7.4.4). After upgrading to 8.32.0 via the PPA this no longer works, the
action.execOnlyWhenPreviousIsSuspended parameter no longer appears to be
triggering. With the configuration snippet I included below, I would
expect the actions named “penny” and “dreadful” to become suspended (due to
the remote servers not existing) but only the first action is triggered
despite it becoming suspended. Am I doing something wrong?
Config extract:
module(load="omprog")
$template event_json,"%msg:2:$%\n"
$template empty,""
ruleset(name="sendEventLogs") {
action(
name="penny"
type="omfwd"
target=“172.29.21.42"
port="10514"
StreamDriver="gtls"
StreamDriverMode="1"
StreamDriverAuthMode="x509/name"
StreamDriverPermittedPeers=“172.29.21.42”
protocol="tcp"
queue.type="LinkedList"
queue.filename="event_172.29.21.42"
queue.saveonshutdown="on"
queue.maxdiskspace="1G"
queue.timeoutenqueue="0"
# action.resumeRetryCount="-1"
action.reportSuspension="on"
action.reportSuspensionContinuation="on"
template="event_json"
)
action(
name="dreadful"
type="omfwd"
target="host2.example.com"
port="10514"
StreamDriver="gtls"
StreamDriverMode="1"
StreamDriverAuthMode="x509/name"
StreamDriverPermittedPeers="host2.example.com"
protocol="tcp"
queue.type="LinkedList"
queue.filename=“event_host2.example.com"
queue.saveonshutdown="on"
queue.maxdiskspace="1G"
queue.timeoutenqueue="0"
# action.resumeRetryCount="-1"
action.reportSuspension="on"
action.reportSuspensionContinuation="on"
action.execOnlyWhenPreviousIsSuspended="on"
template="event_json"
)
action(
name="jessica"
type="omprog"
binary="/opt/platform/apps/services/audit_failure.sh"
template="empty"
action.reportSuspension="on"
action.execOnlyWhenPreviousIsSuspended="on"
action.execOnlyOnceEveryInterval="600"
)
}
if $programname contains 'event' then {
call sendEventLogs
stop
}
Log messages
2018-02-07T12:46:17.448360+00:00 NICVW-STANDALONE-172 rsyslogd: [origin
software="rsyslogd" swVersion="8.32.0" x-pid="236951" x-info="
http://www.rsyslog.com";] start
2018-02-07T12:48:24.015625+00:00 NICVW-STANDALONE-172 rsyslogd: cannot
connect to 172.29.21.42:10514: Connection timed out [v8.32.0 try
http://www.rsyslog.com/e/2027 ]
2018-02-07T12:48:24.015633+00:00 NICVW-STANDALONE-172 rsyslogd: action
'penny' suspended (module 'builtin:omfwd'), retry 0. There should be
messages before this one giving the reason for suspension. [v8.32.0 try
http://www.rsyslog.com/e/2007 ]
2018-02-07T12:50:31.246040+00:00 NICVW-STANDALONE-172 rsyslogd: cannot
connect to 172.29.21.42:10514: Connection timed out [v8.32.0 try
http://www.rsyslog.com/e/2027 ]
2018-02-07T12:50:31.246262+00:00 NICVW-STANDALONE-172 rsyslogd: action
'penny' suspended (module 'builtin:omfwd'), next retry is Wed Feb 7
12:51:01 2018, retry nbr 0. There should be messages before this one giving
the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
2018-02-07T12:52:38.478031+00:00 NICVW-STANDALONE-172 rsyslogd: cannot
connect to 172.29.21.42:10514: Connection timed out [v8.32.0 try
http://www.rsyslog.com/e/2027 ]
2018-02-07T12:52:38.478365+00:00 NICVW-STANDALONE-172 rsyslogd: action
'penny' suspended (module 'builtin:omfwd'), retry 1. There should be
messages before this one giving the reason for suspension. [v8.32.0 try
http://www.rsyslog.com/e/2007 ]
2018-02-07T12:54:45.710029+00:00 NICVW-STANDALONE-172 rsyslogd: cannot
connect to 172.29.21.42:10514: Connection timed out [v8.32.0 try
http://www.rsyslog.com/e/2027 ]
2018-02-07T12:54:45.710363+00:00 NICVW-STANDALONE-172 rsyslogd: action
'penny' suspended (module 'builtin:omfwd'), next retry is Wed Feb 7
12:55:15 2018, retry nbr 1. There should be messages before this one giving
the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
2018-02-07T12:57:23.278087+00:00 NICVW-STANDALONE-172 rsyslogd: cannot
connect to 172.29.21.42:10514: Connection timed out [v8.32.0 try
http://www.rsyslog.com/e/2027 ]
2018-02-07T12:57:23.278397+00:00 NICVW-STANDALONE-172 rsyslogd: action
'penny' suspended (module 'builtin:omfwd'), next retry is Wed Feb 7
12:57:53 2018, retry nbr 2. There should be messages before this one giving
the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
