Hi We are using rsyslog version 7.2.6. With omfwd module forwarding syslogs to a server over tcp, we see a situation (when syslog server is not reading the tcp socket or maybe a firewall rule added drops data to syslog server) where mainqueue builds up to 10,000 messages at which point we are not seeing syslogs in /var/log/messages as well. Messages simply get dropped..after waiting for default time of 2s (MainMsgQueueTimeoutEnqueue) to see if queue has space.
Is there any option in rsyslog that tells that if mainqueue is backed up to 10,000 (is this configurable?), close affected tcp/udp connection and reestablish them. Closest thing we found is 'rebindinterval' but we see the warning about load balancers. We enabled rsyslog debugging and observe that the main thread is reading from /dev/log, waiting for 2s to see if main msg queue has space and then dropping it. If rsyslogd gets to this point is there is any option to stop the thread that is causing the problem? Thank you _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
