Re: [rsyslog] rsyslogd buffering logs?

2012-12-18 Thread Philippe Muller
Hello, Trying to understand rsyslog behavior with that sample config: - If loghost.unet.brandeis.edu is down, messages will pile up in the main queue (because the TCP action has a direct queue by default) - Once the main queue is full, rsyslog will no longer poll /dev/log - Now, rsyslog will no

Re: [rsyslog] rsyslogd buffering logs?

2012-12-18 Thread bodik
Is that the expected behavior of rsyslog with that configuration ? I believe it is. http://www.rsyslog.com/doc/queues.html How can we configure the TCP action in order to prevent the complete locking ? http://www.rsyslog.com/doc/rsyslog_reliable_forwarding.html beside what's written

Re: [rsyslog] rsyslogd buffering logs?

2012-12-18 Thread David Lang
On Tue, 18 Dec 2012, bodik wrote: Is that the expected behavior of rsyslog with that configuration ? I believe it is. http://www.rsyslog.com/doc/queues.html Yes. note that this is not a new failure that rsyslog introduces, it's the standard behavior that syslog has had all along. With

Re: [rsyslog] rsyslogd buffering logs?

2012-12-18 Thread bodik
#forward1 $ActionQueueType LinkedList# use asynchronous processing $ActionQueueFileName srvrfwd1 # set file name, also enables disk mode $ActionResumeRetryCount -1 # infinite retries on insert failure $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog

Re: [rsyslog] rsyslogd buffering logs?

2012-12-18 Thread David Lang
On Tue, 18 Dec 2012, bodik wrote: #forward1 $ActionQueueType LinkedList# use asynchronous processing $ActionQueueFileName srvrfwd1 # set file name, also enables disk mode $ActionResumeRetryCount -1 # infinite retries on insert failure $ActionQueueSaveOnShutdown on #

Re: [rsyslog] rsyslogd buffering logs?

2012-12-18 Thread Rainer Gerhards
-Original Message- From: rsyslog-boun...@lists.adiscon.com [mailto:rsyslog- boun...@lists.adiscon.com] On Behalf Of David Lang Sent: Tuesday, December 18, 2012 2:22 PM To: rsyslog-users Subject: Re: [rsyslog] rsyslogd buffering logs? On Tue, 18 Dec 2012, bodik wrote

[rsyslog] rsyslogd buffering logs?

2012-12-17 Thread John Miller
Hello everyone, I'm running into a strange problem with some new RHEL 6 servers I've built. I can go for days without anything appearing to get logged (to any file/remote server), but then when I restart rsyslog via the provided initscripts, logs magically appear! Obviously there's some

Re: [rsyslog] rsyslogd buffering logs?

2012-12-17 Thread Rainer Gerhards
...@lists.adiscon.com] On Behalf Of John Miller Sent: Monday, December 17, 2012 10:20 PM To: rsyslog@lists.adiscon.com Subject: [rsyslog] rsyslogd buffering logs? Hello everyone, I'm running into a strange problem with some new RHEL 6 servers I've built. I can go for days without anything appearing to get

Re: [rsyslog] rsyslogd buffering logs?

2012-12-17 Thread David Lang
On Mon, 17 Dec 2012, John Miller wrote: On 12/17/2012 05:02 PM, David Lang wrote: My guess is that something is interrupting the TCP connection and logs then stop (possibly a firewall or NAT timeout), logs are then buffered until something gets restarted and they start flowing again. Right