I do - should I not? -----Original Message----- From: David Lang <[email protected]> Sent: Monday, June 10, 2019 3:43 PM To: Heaton, Tobias <[email protected]> Cc: David Lang <[email protected]>; Heaton, Tobias via rsyslog <[email protected]> Subject: RE: [rsyslog] 8.1905.0 Logging Stops
Caution - External Email;;; ******************************************************************************************************************************************** do you have impstats configured to reset it's counters each time it outputs? David Lang On Mon, 10 Jun 2019, Heaton, Tobias wrote: > Date: Mon, 10 Jun 2019 19:37:31 +0000 > From: "Heaton, Tobias" <[email protected]> > To: David Lang <[email protected]> > Cc: "Heaton, Tobias via rsyslog" <[email protected]> > Subject: RE: [rsyslog] 8.1905.0 Logging Stops > > Attached is a snippet of the impstats. Logs stopped writing at 15:00:01. > > -----Original Message----- > From: David Lang <[email protected]> > Sent: Monday, June 10, 2019 3:29 PM > To: Heaton, Tobias <[email protected]> > Cc: David Lang <[email protected]>; Heaton, Tobias via rsyslog > <[email protected]> > Subject: RE: [rsyslog] 8.1905.0 Logging Stops > > Caution - External Email;;; > > ******************************************************************************************************************************************** > On Mon, 10 Jun 2019, Heaton, Tobias wrote: > >> I configured impstats, updated rsyslog, restarted and awaited the failure. >> Tailing the busiest logs, behavior starts normal. Over the course of a few >> minutes, the logs seems to arrive in chunks...or at least appear to write >> that way to disk. >> >> That behavior continues with logs populating incrementally slower and slower >> until it just stops. The impstats don't show anything of consequence - the >> repeated stats are all normal and the same both prior to and after the logs >> stop writing. >> >> Rsyslog appears still running and impstats continue to populate again with >> no appreciable changes - very strange! > > after it stops, does impstats show new messages arriving (and queues > building)? > or does it show outputs failing and messages being discarded? > or something else? > > a couple cycles of the pstats output after it's failed would be useful > > David Lang > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
