Also as per https://www.rsyslog.com/doc/v8-stable/concepts/queues.html :
If a high main message queue enqueue timeout is set, it can lead to something like a complete hang of the system. The same problem does not apply to action queues. So it seems we should set low timeouts (or even 0) for main queue as well. Ani On Mar 15, 2019, 2:08 PM +0530, Ani Sinha <[email protected]>, wrote: On Mar 13, 2019, 11:04 PM +0530, Rainer Gerhards <[email protected]>, wrote: No bug, but a too long timeout. Thus changed several years ago. Yes I see that the default timeout for the action queue was changed from 2000 ms to 50 ms. However, for the main queue, “iMainMsgQtoEnq” remains 2000 ms. Why was it not changed for the main queue? Is it because the 2 sec delay in the action queue processing has greater impact than the delay in main queue? Thanks ani Rainer Sent from phone, thus brief. David Lang via rsyslog <[email protected]> schrieb am Mi., 13. März 2019, 10:24: we would need to see your full config, but if rsyslog fills it's queue (commonly because you have it configured to send to a different machine via TCP and the remote machine is down), it is unable to accept new messages, and the system will stall. This is part of the spec for the syslog protocol, not a bug to be fixed in rsyslog. There are things that are available to help throw away messages faster when the queue fills up, I don't remember when they were added. look for the discard severity and high/low watermark options for a queue. David Lang _______________________________________________ rsyslog mailing list https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.adiscon.net_mailman_listinfo_rsyslog&d=DwIGaQ&c=s883GpUCOChKOHiocYtGcg&r=IIUxIyRwG4RGy57y2nvMNYcDkqW-NHozZ2R38VYcg5U&m=cRwSK-avo2d38qeJY1RByNCkmBcZ7zsjcMpCWkVcSMQ&s=cF1HgTKndEQpO-xbR8IQ_tw5OZhOzH73cyug_XgQFCQ&e= https://urldefense.proofpoint.com/v2/url?u=http-3A__www.rsyslog.com_professional-2Dservices_&d=DwIGaQ&c=s883GpUCOChKOHiocYtGcg&r=IIUxIyRwG4RGy57y2nvMNYcDkqW-NHozZ2R38VYcg5U&m=cRwSK-avo2d38qeJY1RByNCkmBcZ7zsjcMpCWkVcSMQ&s=87moP7zW_wK-EEiY817rXZnP356TWpKuzF8ubVBilhI&e= What's up with rsyslog? Follow https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_rgerhards&d=DwIGaQ&c=s883GpUCOChKOHiocYtGcg&r=IIUxIyRwG4RGy57y2nvMNYcDkqW-NHozZ2R38VYcg5U&m=cRwSK-avo2d38qeJY1RByNCkmBcZ7zsjcMpCWkVcSMQ&s=e_379j0UvS3FR3UeuJb-umE1pkmijpVPf08szOfs-rw&e= NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.adiscon.net_mailman_listinfo_rsyslog&d=DwIGaQ&c=s883GpUCOChKOHiocYtGcg&r=IIUxIyRwG4RGy57y2nvMNYcDkqW-NHozZ2R38VYcg5U&m=cRwSK-avo2d38qeJY1RByNCkmBcZ7zsjcMpCWkVcSMQ&s=cF1HgTKndEQpO-xbR8IQ_tw5OZhOzH73cyug_XgQFCQ&e= https://urldefense.proofpoint.com/v2/url?u=http-3A__www.rsyslog.com_professional-2Dservices_&d=DwIGaQ&c=s883GpUCOChKOHiocYtGcg&r=IIUxIyRwG4RGy57y2nvMNYcDkqW-NHozZ2R38VYcg5U&m=cRwSK-avo2d38qeJY1RByNCkmBcZ7zsjcMpCWkVcSMQ&s=87moP7zW_wK-EEiY817rXZnP356TWpKuzF8ubVBilhI&e= What's up with rsyslog? Follow https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_rgerhards&d=DwIGaQ&c=s883GpUCOChKOHiocYtGcg&r=IIUxIyRwG4RGy57y2nvMNYcDkqW-NHozZ2R38VYcg5U&m=cRwSK-avo2d38qeJY1RByNCkmBcZ7zsjcMpCWkVcSMQ&s=e_379j0UvS3FR3UeuJb-umE1pkmijpVPf08szOfs-rw&e= NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
