On Mon, 10 Jun 2019, Heaton, Tobias wrote:
I do - should I not?
the stats are a little more inaccurate (there is a race condition between
the time that the stats are reported and when they are cleared that new events
can be lost) beyond that it's mostly preference, but the stats analysis tool on
the rsyslog.com website assumes that the counters are not reset.
I don't think it's a big deal, just confirming.
David Lang
-----Original Message-----
From: David Lang <[email protected]>
Sent: Monday, June 10, 2019 3:43 PM
To: Heaton, Tobias <[email protected]>
Cc: David Lang <[email protected]>; Heaton, Tobias via rsyslog
<[email protected]>
Subject: RE: [rsyslog] 8.1905.0 Logging Stops
Caution - External Email;;;
********************************************************************************************************************************************
do you have impstats configured to reset it's counters each time it outputs?
David Lang
On Mon, 10 Jun 2019, Heaton, Tobias wrote:
Date: Mon, 10 Jun 2019 19:37:31 +0000
From: "Heaton, Tobias" <[email protected]>
To: David Lang <[email protected]>
Cc: "Heaton, Tobias via rsyslog" <[email protected]>
Subject: RE: [rsyslog] 8.1905.0 Logging Stops
Attached is a snippet of the impstats. Logs stopped writing at 15:00:01.
-----Original Message-----
From: David Lang <[email protected]>
Sent: Monday, June 10, 2019 3:29 PM
To: Heaton, Tobias <[email protected]>
Cc: David Lang <[email protected]>; Heaton, Tobias via rsyslog
<[email protected]>
Subject: RE: [rsyslog] 8.1905.0 Logging Stops
Caution - External Email;;;
********************************************************************************************************************************************
On Mon, 10 Jun 2019, Heaton, Tobias wrote:
I configured impstats, updated rsyslog, restarted and awaited the failure.
Tailing the busiest logs, behavior starts normal. Over the course of a few
minutes, the logs seems to arrive in chunks...or at least appear to write that
way to disk.
That behavior continues with logs populating incrementally slower and slower
until it just stops. The impstats don't show anything of consequence - the
repeated stats are all normal and the same both prior to and after the logs
stop writing.
Rsyslog appears still running and impstats continue to populate again with no
appreciable changes - very strange!
after it stops, does impstats show new messages arriving (and queues building)?
or does it show outputs failing and messages being discarded?
or something else?
a couple cycles of the pstats output after it's failed would be useful
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
