Although I am not well versed in the old style syntax your configuration
looks correct to me although you might want to investigate using the
following parameters in your action.
Action.ResumeInterval="1"
Action.ResumeRetryCount="-1"
Question: Are you sure the queued messages weren't delivered to the
network destination? The draining happens slowly (I do not know the
logic) and the queue file does not immediately disappear even if
emptied. If rsyslog deletes it later at startup or shutdown that's a
good indication it was drained successfully.
Comments: Your rsyslog version is more than a year old. Check the
release notes for fixes to the queuing system, there have certainly been
some over time. Also, there has been some VERY recent and fairly
detailed discussion here in this list on the topic of queues. Track back
a week or two in the list history and you'll see them.
Regards,
On 4/18/20 9:29 AM, TaSK via rsyslog wrote:
Setup is quite simple:
- An application sending 5 log messages per second
- A local rsyslogd server (8.1901) with the following simple setup:
$WorkDirectory /var/spool/rsyslog
module(load="imuxsock")
module(load="imudp")
input(type="imudp" port="514")
*.* action (
type="omfwd"
queue.type="LinkedList"
queue.filename="forwarding"
queue.size="1000"
queue.maxFileSize="8m"
target="192.168.100.30"
protocol="tcp"
port="514"
)
*.* /var/spool/rsyslog/test-file
- A server that dumps to disk.
If I disconnect the server, messages starts piling up, and after a while
ends up on disk in the expected file (forwarding.00000001). Messages are
continuously being logged to the test-file, so everything is working.
On reconnect, the messages immediately starts flowing again. But the queue
is not drained. Thousands of messages remain on disk on the client side.
After an hour I restarted rsyslogd on the client side. On restart, the
file with the queued messages was deleted., but not sent. Thus, all
messages that were buffered were lost.
A pointer to where I have erred in my setup would be very appreciated!
[TaSK]
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
