Re: [rsyslog] Repeated 111 to rsyslog UDS from nginx

2023-09-21 Thread TG Servers via rsyslog
yes, as said reject_unknown_client_hostname is relatively strict, one needs to set an exception now and then if the server is legit in the end... but it's not legit requests more often... https://www.postfix.org/postconf.5.html#reject_unknown_reverse_client_hostname On 21/09/2023 21:06, David

Re: [rsyslog] Repeated 111 to rsyslog UDS from nginx

2023-09-21 Thread TG Servers via rsyslog
yes that was in the first message, I reimplemented everything, it is working without any issues now. that was not the problem btw. that was not even there at the time of the first message, this is actually the reimplementatiom I did on the rsyslog side. as said, it works without any issues

Re: [rsyslog] Repeated 111 to rsyslog UDS from nginx

2023-09-21 Thread TG Servers via rsyslog
now we are drifting away completely I am afraid. Please don't talk to me like I am slow, I know what journald is "when you say you aren't using journald"... I don't, for this use case I don't "and are just sending the logs to systemd"...where do I send a log to systemd? Or say I send a log to

Re: [rsyslog] Repeated 111 to rsyslog UDS from nginx

2023-09-21 Thread Joan Sala via rsyslog
(Disclaimer: I have not read all this thread in depth.) This flag "confirmMessages=on" sounds suspicious. With this flag, omprog waits for the script to confirm each received log line (if I recall well), but your script (looking at your first message) doesn't seem to do this (?) (to be sure we

Re: [rsyslog] Repeated 111 to rsyslog UDS from nginx

2023-09-21 Thread David Lang via rsyslog
hmm, dlang@dlang-mobile:~$ nslookup 66.167.227.145 8.8.8.8 145.227.167.66.in-addr.arpa name = mail.lang.hm. Authoritative answers can be found from: dlang@dlang-mobile:~$ nslookup mail.lang.hm 8.8.8.8 Server: 8.8.8.8 Address:8.8.8.8#53 Non-authoritative answer: Name:

Re: [rsyslog] Repeated 111 to rsyslog UDS from nginx

2023-09-21 Thread David Lang via rsyslog
That is a queue on the output, but the incoming message still goes to the main queue. create a ruleset for the input and put a queue on that ruleset to avoid the message going into the main queue. when you say you aren't useing journald, and are just sending the logs to systemd, you aren't

Re: [rsyslog] Repeated 111 to rsyslog UDS from nginx

2023-09-21 Thread TG Servers via rsyslog
I don't think we are talking same things anymore. I told you several times journald is not involved in this. you cannot find 1 line of these logs in journald, so I am not using journald as queue, because I am not using journald at all for this process. "you did not configure rsyslog to use a

Re: [rsyslog] Repeated 111 to rsyslog UDS from nginx

2023-09-21 Thread TG Servers via rsyslog
this is a standard reject_unknown_client_hostname from postfix, this is relatively strict, but ususally no problem on clean servers, I have only a handful exceptions this is not the IP you sent from...the mail came from 66.167.227.145 cannot find your hostname, [66.167.227.145]; from= to=

Re: [rsyslog] Repeated 111 to rsyslog UDS from nginx

2023-09-21 Thread TG Servers via rsyslog
___ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a

Re: [rsyslog] Repeated 111 to rsyslog UDS from nginx

2023-09-21 Thread David Lang via rsyslog
On Thu, 21 Sep 2023, TG Servers wrote:  I did not get a single message from you David regarding that, that confused me quite a bit as Rainer mentioned you already before, now I know why : 450 4.7.25 Client host rejected: cannot find your hostname, [66.167.xxx.xxx]; from= to= proto=ESMTP helo=

Re: [rsyslog] Repeated 111 to rsyslog UDS from nginx

2023-09-21 Thread David Lang via rsyslog
if you are sending logs to journald and having journald send logs to syslog, you are using journald as a queue for the delivery when you were delivering directly to rsyslog, what was probably happening (we don't know because you never enabled impstats to see) is that the logs were arriving,

Re: [rsyslog] Repeated 111 to rsyslog UDS from nginx

2023-09-21 Thread TG Servers via rsyslog
 I did not get a single message from you David regarding that, that confused me quite a bit as Rainer mentioned you already before, now I know why : 450 4.7.25 Client host rejected: cannot find your hostname, [66.167.xxx.xxx]; from= to= proto=ESMTP helo= made an exception now But to the

Re: [rsyslog] Repeated 111 to rsyslog UDS from nginx

2023-09-21 Thread David Lang via rsyslog
depends on the journald config. It can be configured to queue to disk, with limits on disk size. David Lang On Thu, 21 Sep 2023, Rainer Gerhards wrote: I guess it works because journal always throws messages away if it cannot deliver them quickly. Luke a very short timeout+drop queue config

Re: [rsyslog] Repeated 111 to rsyslog UDS from nginx

2023-09-21 Thread Rainer Gerhards via rsyslog
I guess it works because journal always throws messages away if it cannot deliver them quickly. Luke a very short timeout+drop queue config in rsyslog. Rainer Sent from phone, thus brief. David Lang schrieb am Do., 21. Sept. 2023, 08:23: > now you have journald acting as a queue, so all

Re: [rsyslog] Repeated 111 to rsyslog UDS from nginx

2023-09-21 Thread David Lang via rsyslog
now you have journald acting as a queue, so all messages from journald will end up delayed when your script cannot keep up. You haven't solved the problem of the slow script, you've just added another layer of buffer to fill up before you notice. with rsyslog you can set the queue size to