hi,all
i have configured ats to log to pipe, and tell the rsyslog on ats'host to read
the pipe and forward logs to the remote rsyslog server~
the reasons i use rsyslog is:
1) i want to filter the logs by url using regular expression
2) the logs shoud forward to a remote rsyslog server
my configuration like this:
#####################################################################
logs_xml.config
<LogObject>
<Format = "squid"/>
<Filename = "trafficserver.pipe"/>
<Mode = "ascii_pipe"/>
<RollingEnabled = "0"/>
<Filters = "not_empty,not_invalid"/>
</LogObject>
#####################################################################
rsyslog:
$ModLoad imfile
$InputFileName trafficserver.pipe
$InputFileTag trafficserver
$InputFileStateFile trafficserver.state
$InputFileSeverity error
$InputFileFacility local7
$InputRunFileMonitor
$InputFilePollInterval 2
if $syslogtag == 'trafficserver' then @@192.168.10.136
& ~
#####################################################################
it works well for some time, but occasionally , probably the busy time, ATS
complain that(found the following log in traffic.out)
"Server {0x465fab90} ERROR: An error was encountered in writing to
/home/trafficserver/log/trafficserver.pipe: Resource temporarily unavailable."
when this happen, the log forwarding will slow down, and some logs will miss~
i don't konw why?
I guess ats's write too fast ? or rsyslog's read too slow ?
i configure rsyslog to read the pipe more frequently (by 2 seconds), but
without work....
so i think the problem may be ats write to the pipe to fast,
can we control the speed that ats write the log ?
thanks all