2012/3/14 Kaiwang Chen <[email protected]>: > 2012/3/13 Rainer Gerhards <[email protected]>: >> >> >>> -----Original Message----- >>> From: [email protected] [mailto:rsyslog- >>> [email protected]] On Behalf Of Kaiwang Chen >>> Sent: Tuesday, March 13, 2012 2:28 PM >>> To: rsyslog-users >>> Subject: Re: [rsyslog] lots of queue files left in working directory >>> >>> 2012/3/13 Rainer Gerhards <[email protected]>: >>> > [snip] >>> >> Anyway, I will verify it. >>> > If your run 5.8.6, no need to verify as you are not affected. I will >>> try to >>> > reproduce the issue with that version, but I will then probably need >>> a debug >>> > log from you, as I tried yesterday and the problem disappeared once >>> the fix >>> > went in. >>> >>> I found the disk queue index file (mq.qi in my ase) was lost, as a >>> result qqueueTryLoadPersistedInfo() failed to detect the queue >>> files... >>> With full list of mq.<number>, is it possible to assemble the >>> corresponding index named mq.qi? Although the reason why it was >>> missing remains unknown, I'd better have the queue recovered. >> >> Unfortunately, there currently is no function to rebuild the .qi file. It is >> not really hard to do manually. I'll check if I can extract the necessary >> information. > > I worked out a tool(enclosed) to help rebuild .qi file, in my case: > # perl recover_qi.pl -w /var/spool/rsyslog/ -f mq -d 8 > >/var/spool/rsyslog/mq.qi > # cat /var/spool/rsyslog/mq.qi > <OPB:1:qqueue:1: > +iQueueSize:2:7:8726880: > +tVars.disk.bytesRead:2:1:0: > +tVars.disk.sizeOnDisk:2:10:4124216524: >>End > . > <Obj:1:strm:1: > +tOperationsMode:2:1:4:
I should point out rsyslogd saved .qi files use "+tOperationsMode:2:1:2:", i.e. STREAMMODE_WRITE here. Not sure of potential result of my using STREAMMODE_WRITE_APPEND instead. In case of any problem, apply the following patch. Anyway the order of properties is irrelevant. --- recover_qi.pl.orig 2012-03-17 17:22:02.930104994 +0800 +++ recover_qi.pl 2012-03-17 18:01:15.919279050 +0800 @@ -7,6 +7,9 @@ # # [email protected] 2012-03-14 # +# Changelog +# 2012-03-17 use STREAMMODE_WRITE instead of STREAMMODE_WRITE_APPEND +# to be consistent with rsyslogd-saved index use strict; use Getopt::Long; @@ -64,7 +67,7 @@ my $STREAMTYPE_FILE_CIRCULAR = 1; # runtime/stream.h: strmMode_t my $STREAMMODE_READ = 1; -my $STREAMMODE_WRITE_APPEND = 4; +my $STREAMMODE_WRITE = 2; # runtime/stream.c: strmSerialize() # write to end @@ -74,7 +77,7 @@ $strm_Write->property( "iMaxFiles", "INT", $iMaxFiles); $strm_Write->property( "bDeleteOnClose", "INT", 0); $strm_Write->property( "sType", "INT", $STREAMTYPE_FILE_CIRCULAR); -$strm_Write->property("tOperationsMode", "INT", $STREAMMODE_WRITE_APPEND); +$strm_Write->property("tOperationsMode", "INT", $STREAMMODE_WRITE); $strm_Write->property( "tOpenMode", "INT", 0600); $strm_Write->property( "iCurrOffs","INT64", $iCurrOffs_Write); # read from head > +iMaxFiles:2:8:10000000: > +bDeleteOnClose:2:1:0: > +pszFName:1:2:mq: > +tOpenMode:2:3:384: > +iCurrFNum:2:3:787: > +sType:2:1:1: > +iCurrOffs:2:7:3125007: >>End > . > <Obj:1:strm:1: > +tOperationsMode:2:1:1: > +iMaxFiles:2:8:10000000: > +bDeleteOnClose:2:1:1: > +pszFName:1:2:mq: > +tOpenMode:2:3:384: > +iCurrFNum:2:1:1: > +sType:2:1:1: > +iCurrOffs:2:1:0: >>End > . > # perl recover_qi.pl -h > Usage: > recover_qi.pl -w WorkDirectory -f QueueFileName -d 8 > QueueFileName.qi > > However, I have no idea why the last queue file mq.00000787 was not > deleted after last entry had been delivered. So did the mq.qi file. > Both failed to survive across restart though. > > When rsyslogd was busy processing disk queue, I sent a message vai > logger(1), it almost immediately appeared in the /var/log/messages > file. Why? Shouldn't it appear after the disk queue entries? > >> >> Rainer >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ > > Thanks, > Kaiwang Thanks, Kaiwang _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/
