Re: [rsyslog] rsyslog queues gets emptied on suspend?

[Simon Lundström]

On Wed, 2018-11-28 at 12:24:24 +0100, Rainer Gerhards wrote:
El mié., 28 nov. 2018 a las 12:16, Simon Lundström (<si...@su.se>) escribió:

Hey all!

While trying to setup queueing like we want it to I wonder if we've
found a bug or most likely doing something wrong. We've set limits very
low just to make sure we fill the queue fast for testing. We're running
8.24.0-1 from Debian 9 Stretch and this is our config with comments
removed:

module(load="imuxsock"
  SysSock.RateLimit.Interval="0"
)
module(load="imklog")
module(load="builtin:omfile"
  dirCreateMode="0755"
  fileCreateMode="0644"
  fileGroup="adm"
  fileOwner="root"
)

global(
  workDirectory="/var/spool/rsyslog"
  MaxMessageSize="64k"
  preserveFQDN="on"
  action.reportSuspensionContinuation="on"
)

if $fromhost-ip == "127.0.0.1" then {
  action(
    type="omfile"
    name="omfile-/var/log/messages"
    File="/var/log/messages"
  )
}

module(load="imtcp")
module(load="imudp")
module(load="impstats"
  format="json-elasticsearch"
  interval="5"
)

module(load="omprog")
if $fromhost-ip == "127.0.0.1" and $programname == "rsyslogd-pstats" then {
  action(
    name="action-omprog-impstats"
    type="omprog"
    binary="/local/nrpe/libexec/check_rsyslogd.pl --write"
  )
}

input(type="imtcp"
  port="514"
)

action(type="omfwd"
  name="om-logstash"
  target="127.0.0.1"
  port="2514"
  protocol="tcp"
  template="RSYSLOG_ForwardFormat"
  action.resumeRetryCount="1"

This tells rsyslog to do one retry, and if it fails suspend the
action. A suspended action will drop messages sent to it.

That's exactly what we want but that's not what we're seeing. I wrote in 
my original mail what happens but if I was unclear let me know how I can 
expand and explain!

Did you mean "-1" (wait forever)?

No, as I wrote we want rsyslog to start dropping the incoming logs when 
the queues are full and the action is suspended.

BR,
- Simon
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.