I configured impstats, updated rsyslog, restarted and awaited the failure. Tailing the busiest logs, behavior starts normal. Over the course of a few minutes, the logs seems to arrive in chunks...or at least appear to write that way to disk.
That behavior continues with logs populating incrementally slower and slower until it just stops. The impstats don't show anything of consequence - the repeated stats are all normal and the same both prior to and after the logs stop writing. Rsyslog appears still running and impstats continue to populate again with no appreciable changes - very strange! -----Original Message----- From: David Lang <[email protected]> Sent: Monday, June 10, 2019 2:08 PM To: Heaton, Tobias via rsyslog <[email protected]> Cc: Heaton, Tobias <[email protected]> Subject: Re: [rsyslog] 8.1905.0 Logging Stops Caution - External Email;;; ******************************************************************************************************************************************** right now we have limited info on this problem do you have impstats setup? can you show us what it outputs when logging stops? if you can manage to get debug output over the time that it stops, that would be wonderful. David Lang On Mon, 10 Jun 2019, Heaton, Tobias via rsyslog wrote: > Date: Mon, 10 Jun 2019 14:28:50 +0000 > From: "Heaton, Tobias via rsyslog" <[email protected]> > To: rsyslog-users <[email protected]> > Cc: "Heaton, Tobias" <[email protected]> > Subject: Re: [rsyslog] 8.1905.0 Logging Stops > > I'm trying to bump this thread - just tried upgrading again to 8.11905.0-2 > and after about 10 minutes, all logging stops. No indication of any errors. > Restarting rsyslog brings things back, but then 10 minutes later again, > everything stops. > > This is happening on two separate EL6 boxes. Rolling back to 8.1904.0-1 > restores all functionality. > > -----Original Message----- > From: rsyslog <[email protected]> On Behalf Of Heaton, Tobias > via rsyslog > Sent: Monday, June 3, 2019 2:07 PM > To: [email protected] > Cc: Heaton, Tobias <[email protected]> > Subject: [rsyslog] 8.1905.0 Logging Stops > > I have two EL6 hosts running rsyslog, one of which writes log files to disk > while the other writes to a MySQL database. > > I upgraded each host to 8.1905.0 Friday, 2019-05-30 and since that time, > logging on both systems seems to stop for no apparent reason. I don't see any > error messages. > > Restarting rsyslog on each host restores functionality for 45-60 minutes, > then it stops logging again. I have rolled back to 8.1904.0 and haven't seen > this behavior repeat. > > Is there a potential problem with 8.1905.0? The rsyslog configs on each EL > host haven't changed since the upgrade Friday, nor have any other packages > been installed/uninstalled. > _______________________________________________ > rsyslog mailing list > https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.adiscon.net_mailman_listinfo_rsyslog&d=DwICAg&c=c6MrceVCY5m5A_KAUkrdoA&r=Gev2oD_cwBaLsgGrQ_lnBXqGXR9EUvddO5r7UxzqP5s&m=69LNvD0eBSW_bd9n5hRj31IPXxnM93WteRS1aO85B5Y&s=2q-GoaOF6VeslY-8UgQExfBrLbo0ZaXisN9i5cDINbM&e= > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow > https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_rgerhards&d=DwICAg&c=c6MrceVCY5m5A_KAUkrdoA&r=Gev2oD_cwBaLsgGrQ_lnBXqGXR9EUvddO5r7UxzqP5s&m=69LNvD0eBSW_bd9n5hRj31IPXxnM93WteRS1aO85B5Y&s=U7eRJEj9cb1xwPtzTjtpJjVSEk0l54In0HgVbTdb_6M&e= > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. > _______________________________________________ > rsyslog mailing list > https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.adiscon.net_mailman_listinfo_rsyslog&d=DwIBAg&c=c6MrceVCY5m5A_KAUkrdoA&r=Gev2oD_cwBaLsgGrQ_lnBXqGXR9EUvddO5r7UxzqP5s&m=0w2XdtyZl5a52NEqzpJvoEWkZGPONmoDHL776Egzeuw&s=d-SZrocyZ9NIBE99melwdUvrw0yiTQKyli-e6xOcCy8&e= > > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow > https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_rgerhards&d=DwIBAg&c=c6MrceVCY5m5A_KAUkrdoA&r=Gev2oD_cwBaLsgGrQ_lnBXqGXR9EUvddO5r7UxzqP5s&m=0w2XdtyZl5a52NEqzpJvoEWkZGPONmoDHL776Egzeuw&s=FsdDeXNoDiy4qXbSpxVO7RTEdP8mRG-blTsbcPjCVTs&e= > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
