Hello,
Say you have a config like the following:
*.* @@192.168.1.2:1514
$ActionExecOnlyWhenPreviousIsSuspended on
& /var/log/localbuffer
$ActionExecOnlyWhenPreviousIsSuspended off
...
How do you deal with 192.168.1.2 accepting a connection but stalling it?
I.e. in our case 192.168.1.2 is a Logstash instance, with Elasticsearch
as backend. If Elasticsearch is not available, Logstash stalls the
incoming connections (here rsyslog) using TCP zero window.
This does not seem to trigger the failover action and thus not fail over
to /var/log/localbuffer as configured.
I'm not exactly sure what happened but this seems to have been the
reason why the machine running rsyslog came to a grinding halt and
several of its processes stopped responding.
Thoughts?
Thanks,
Marki
(rsyslog-8.24)
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
