2018-02-09 5:58 GMT+01:00 Nicholas von Waltsleben via rsyslog
<rsyslog@lists.adiscon.com>:
> Upon further investigation it appears this only happens when a queue is
> configured for the action.  It sounds like a bug that was previously fixed
> after 8.10 (https://github.com/rsyslog/rsyslog/issues/375), has there
> perhaps been a regression in this area?

Thanks, I need to investigate, but somehow this does not look wrong.
For a quick (and better!) fix, I suggest to put the queue on the rule
set instead of the individual actions. That will also be faster.

Rainer
>
> Regards,
> Nic
>
>
> On 08 February 2018 at 10:20:27, Nicholas von Waltsleben (
> nicholas.vonwaltsle...@voss-solutions.com) wrote:
>
>
> Hi
>
> I seem to be running into an issue with rsyslog 8.32.0 running on Ubuntu
> 14.04.  I have actions configured to fire when the previous action is
> suspended, and was working fine with the version included with Ubuntu
> (7.4.4). After upgrading to 8.32.0 via the PPA this no longer works, the
> action.execOnlyWhenPreviousIsSuspended parameter no longer appears to be
> triggering.  With the configuration snippet I included below, I would
> expect the actions named “penny” and “dreadful” to become suspended (due to
> the remote servers not existing) but only the first action is triggered
> despite it becoming suspended.  Am I doing something wrong?
>
> Config extract:
>
> module(load="omprog")
>
> $template event_json,"%msg:2:$%\n"
> $template empty,""
>
> ruleset(name="sendEventLogs") {
>     action(
>         name="penny"
>         type="omfwd"
>         target=“172.29.21.42"
>         port="10514"
>         StreamDriver="gtls"
>         StreamDriverMode="1"
>         StreamDriverAuthMode="x509/name"
>         StreamDriverPermittedPeers=“172.29.21.42”
>         protocol="tcp"
>         queue.type="LinkedList"
>         queue.filename="event_172.29.21.42"
>         queue.saveonshutdown="on"
>         queue.maxdiskspace="1G"
>         queue.timeoutenqueue="0"
>         # action.resumeRetryCount="-1"
>         action.reportSuspension="on"
>         action.reportSuspensionContinuation="on"
>         template="event_json"
>     )
>     action(
>         name="dreadful"
>         type="omfwd"
>         target="host2.example.com"
>         port="10514"
>         StreamDriver="gtls"
>         StreamDriverMode="1"
>         StreamDriverAuthMode="x509/name"
>         StreamDriverPermittedPeers="host2.example.com"
>         protocol="tcp"
>         queue.type="LinkedList"
>         queue.filename=“event_host2.example.com"
>         queue.saveonshutdown="on"
>         queue.maxdiskspace="1G"
>         queue.timeoutenqueue="0"
>         # action.resumeRetryCount="-1"
>         action.reportSuspension="on"
>         action.reportSuspensionContinuation="on"
>         action.execOnlyWhenPreviousIsSuspended="on"
>         template="event_json"
>     )
>     action(
>         name="jessica"
>         type="omprog"
>         binary="/opt/platform/apps/services/audit_failure.sh"
>         template="empty"
>         action.reportSuspension="on"
>         action.execOnlyWhenPreviousIsSuspended="on"
>         action.execOnlyOnceEveryInterval="600"
>     )
> }
>
> if $programname contains 'event' then {
>     call sendEventLogs
>     stop
> }
>
> Log messages
>
> 2018-02-07T12:46:17.448360+00:00 NICVW-STANDALONE-172 rsyslogd:  [origin
> software="rsyslogd" swVersion="8.32.0" x-pid="236951" x-info="
> http://www.rsyslog.com";] start
> 2018-02-07T12:48:24.015625+00:00 NICVW-STANDALONE-172 rsyslogd: cannot
> connect to 172.29.21.42:10514: Connection timed out [v8.32.0 try
> http://www.rsyslog.com/e/2027 ]
> 2018-02-07T12:48:24.015633+00:00 NICVW-STANDALONE-172 rsyslogd: action
> 'penny' suspended (module 'builtin:omfwd'), retry 0. There should be
> messages before this one giving the reason for suspension. [v8.32.0 try
> http://www.rsyslog.com/e/2007 ]
> 2018-02-07T12:50:31.246040+00:00 NICVW-STANDALONE-172 rsyslogd: cannot
> connect to 172.29.21.42:10514: Connection timed out [v8.32.0 try
> http://www.rsyslog.com/e/2027 ]
> 2018-02-07T12:50:31.246262+00:00 NICVW-STANDALONE-172 rsyslogd: action
> 'penny' suspended (module 'builtin:omfwd'), next retry is Wed Feb  7
> 12:51:01 2018, retry nbr 0. There should be messages before this one giving
> the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
> 2018-02-07T12:52:38.478031+00:00 NICVW-STANDALONE-172 rsyslogd: cannot
> connect to 172.29.21.42:10514: Connection timed out [v8.32.0 try
> http://www.rsyslog.com/e/2027 ]
> 2018-02-07T12:52:38.478365+00:00 NICVW-STANDALONE-172 rsyslogd: action
> 'penny' suspended (module 'builtin:omfwd'), retry 1. There should be
> messages before this one giving the reason for suspension. [v8.32.0 try
> http://www.rsyslog.com/e/2007 ]
> 2018-02-07T12:54:45.710029+00:00 NICVW-STANDALONE-172 rsyslogd: cannot
> connect to 172.29.21.42:10514: Connection timed out [v8.32.0 try
> http://www.rsyslog.com/e/2027 ]
> 2018-02-07T12:54:45.710363+00:00 NICVW-STANDALONE-172 rsyslogd: action
> 'penny' suspended (module 'builtin:omfwd'), next retry is Wed Feb  7
> 12:55:15 2018, retry nbr 1. There should be messages before this one giving
> the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
> 2018-02-07T12:57:23.278087+00:00 NICVW-STANDALONE-172 rsyslogd: cannot
> connect to 172.29.21.42:10514: Connection timed out [v8.32.0 try
> http://www.rsyslog.com/e/2027 ]
> 2018-02-07T12:57:23.278397+00:00 NICVW-STANDALONE-172 rsyslogd: action
> 'penny' suspended (module 'builtin:omfwd'), next retry is Wed Feb  7
> 12:57:53 2018, retry nbr 2. There should be messages before this one giving
> the reason for suspension. [v8.32.0 try http://www.rsyslog.com/e/2007 ]
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T 
> LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

Reply via email to