Re: [rsyslog] Qualys scan against rsyslog causes it to segfault

2017-10-23 Thread deoren
On 10/7/2017 10:44 AM, deoren wrote: On 10/7/2017 5:25 AM, Rainer Gerhards wrote: 2017-10-07 7:57 GMT+02:00 deoren : As I dig more into this, I'm beginning to think the only thing the Qualys scan did was aggravate an existing problem and cause

Re: [rsyslog] Qualys scan against rsyslog causes it to segfault

2017-10-23 Thread David Lang
do you have a tcpdump or info from Qualys saying what it sends as part of the scan? David Lang ___ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow

Re: [rsyslog] Qualys scan against rsyslog causes it to segfault

2017-10-23 Thread deoren
On 10/23/2017 7:11 PM, David Lang wrote: do you have a tcpdump or info from Qualys saying what it sends as part of the scan? David Lang Thankfully (for troubleshooting purposes), the problem isn't specific to the Qualys scan. I later learned that messages coming from our ESXi hosts

Re: [rsyslog] Qualys scan against rsyslog causes it to segfault

2017-10-23 Thread deoren
On 10/23/2017 7:38 PM, deoren wrote: On 10/23/2017 7:11 PM, David Lang wrote: do you have a tcpdump or info from Qualys saying what it sends as part of the scan? David Lang Thankfully (for troubleshooting purposes), the problem isn't specific to the Qualys scan. I later learned that

Re: [rsyslog] Qualys scan against rsyslog causes it to segfault

2017-10-23 Thread deoren
On 10/23/2017 7:51 PM, deoren wrote: On 10/23/2017 7:38 PM, deoren wrote: On 10/23/2017 7:11 PM, David Lang wrote: do you have a tcpdump or info from Qualys saying what it sends as part of the scan? David Lang Thankfully (for troubleshooting purposes), the problem isn't specific to the

[rsyslog] RES: Client/server architecture with omrelp/imrelp - Lost of messages in case of server side failure

2017-10-23 Thread Jether B. Santos via rsyslog
Hello, I realized the parameter RebindInterval was causing duplicated messages in both balanced servers. I removed that and apparentely the messages haven't been lost anymore. Tomorrow I will stress it more. Regards, Jether De: Jether B. Santos Enviada em: segunda-feira, 23 de outubro de

[rsyslog] Client/server architecture with omrelp/imrelp - Lost of messages in case of server side failure

2017-10-23 Thread Jether B. Santos via rsyslog
Hi everybody, I'm testing the following rsyslog client/server architecture: - Client side: a rsyslog server that consumes messages from a local apache log file through imfile module. The main worker threads save the messages in a disk assisted queue of an omrelp action. The action threads