Hi,
When using omfwd with udp, at startup one gets 'omfwd: error 101 sending via
udp: Network is unreachable' errors until the interface is up. With tcp clearly
one does not get these, but our preference is to use udp on networking devices
so as to avoid a potentially large number of queued messages being sent after
loss of connectivity, also udp is more performant albeit less reliable.
This approach works with rsyslog v8.24.0 (in Debian Stretch), where omfwd
itself rate-limits these error messages to 5. However, with rsyslog v8.33.1 (in
Debian Sid) this rough rate-limiting was removed by the commit 35ae24c8a689
("omfwd/udp: improve error reporting, depricate maxerrormessages parameter"),
so at startup there are now for example 30 to 120 of these error messages.
Is there a way of rate-limiting these on client-side without rate-limiting
other error messages?
Or is there a way of consolidating the error messages to state e.g. 'repeated x
number of times' when logging and forwarding them? I don't think this is
possible though, as for each such error message there there is also a sendto()
error message, i.e.:
Apr 20 08:24:31 vm2 rsyslogd[468]: omfwd/udp: socket 7: sendto() error: Network
is unreachable [v8.33.1 try http://www.rsyslog.com/e/2354 ]
Apr 20 08:24:31 vm2 rsyslogd[468]: omfwd: socket 7: error 101 sending via udp:
Network is unreachable [v8.33.1 try http://www.rsyslog.com/e/2354 ]
Apr 20 08:24:31 vm2 rsyslogd[468]: action 'action 1' suspended (module
'builtin:omfwd'), retry 0. There should be messages before this one giving the
reason for suspension. [v8.
Apr 20 08:24:31 vm2 rsyslogd[468]: action 'action 1' resumed (module
'builtin:omfwd') [v8.33.1 try http://www.rsyslog.com/e/2359 ]
[so this set is repeated x number of times]
Thanks for any advice,
Mike
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
