I was not able to reproduce the ssh getting stuck problem with rsyslog7. Further restarting rsyslog 5.8 daemon unstuck ssh, that is, fixed the issue. Also when I set the following on rsyslog 5.8
$ActionQueueTimeoutEnqueue 0 $MainMsgQueueTimeoutEnqueue 0 the issue went away. So I think the issue which I am seeing has something to do with the 2 sec timeout (before dropping the log) which rsyslog implements when queues are full. “/dev/log” is created by rsyslog itself (see imuxsock.c module). So all this makes sense now. SSH is unable to write to “/dev/log” and is stuck indirectly on the queue mutex while we wait for the timeout to occur. Ani On Mar 13, 2019, 2:02 PM +0530, Peter Viskup <[email protected]>, wrote: We have been facing the same issue. It is related to "full buffer" for /dev/log device, which is used by sudo, PAM, SSH and other services to log authentication messages. The "unavailability" is caused by SSH not able to write to /dev/log. The same issue might appear with use of any other syslog server. Peter On Tue, Mar 12, 2019 at 6:32 PM Ani Sinha via rsyslog <[email protected]<mailto:[email protected]>> wrote: Hi guys, We rsyslog 5.8 in our centOS 6 based systems and we have bumped into the much discussed syslog issue where when log forwarding is enabled using tcp and the remote server is unavailable, after some time, the ssh connection to the host dies. I have been able to reproduce it and I believe the issue arises from the 2 sec default timeout interval set for messages to wait when the spooled queue (In-memory or disk or disk assisted) is completely full. Restarting the rsyslog service promptly bring ssh connectivity back. I have also experimented with rsyslog7 on centOS 6 system and I do not see the same issue. Can someone please throw some light as to what changed between rsyslog 5.8 and rsyslog 7.10 that the issue has been fixed. Are there other issues with rsyslog7 which I should be aware of? thanks ani _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog [lists.adiscon.net]<https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.adiscon.net_mailman_listinfo_rsyslog&d=DwMFaQ&c=s883GpUCOChKOHiocYtGcg&r=IIUxIyRwG4RGy57y2nvMNYcDkqW-NHozZ2R38VYcg5U&m=8v_v9lgsyr0WQUC4JVkrQO5QfCkfdMyA1AMFiE1SdYc&s=KJaRXOl5xyZ91bQ_Bq1PmovMNYSY93aef-tXNr5HA2A&e=> http://www.rsyslog.com/professional-services/ [rsyslog.com]<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.rsyslog.com_professional-2Dservices_&d=DwMFaQ&c=s883GpUCOChKOHiocYtGcg&r=IIUxIyRwG4RGy57y2nvMNYcDkqW-NHozZ2R38VYcg5U&m=8v_v9lgsyr0WQUC4JVkrQO5QfCkfdMyA1AMFiE1SdYc&s=as3qu3JQEh3w7_TeR12tH60bWuBLu5EPmzXWYQtl_n0&e=> What's up with rsyslog? Follow https://twitter.com/rgerhards [twitter.com]<https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_rgerhards&d=DwMFaQ&c=s883GpUCOChKOHiocYtGcg&r=IIUxIyRwG4RGy57y2nvMNYcDkqW-NHozZ2R38VYcg5U&m=8v_v9lgsyr0WQUC4JVkrQO5QfCkfdMyA1AMFiE1SdYc&s=jN2ThfGgLKwN0S6l2U92m_cQDtPhBbve5ZxagcYeBp0&e=> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
