On Tue, 18 Dec 2012, bodik wrote:
Is that the expected behavior of rsyslog with that configuration ?
I believe it is. http://www.rsyslog.com/doc/queues.html
Yes.
note that this is not a new failure that rsyslog introduces, it's the standard
behavior that syslog has had all along.
With the traditional syslog daemon, if the TCP connection blocked, you could not
log anything, and everything that would try to log would block (it had no
internal queue to buffer things)
Also, if you didn't log remotely and your syslog daemon was unable to write to
disk (full disk or disk error), the same thing would happen.
How can we configure the TCP action in order to prevent the complete
locking ?
http://www.rsyslog.com/doc/rsyslog_reliable_forwarding.html
beside what's written there, this is my setup which I'm very fine with:
#forward1
$ActionQueueType LinkedList # use asynchronous processing
$ActionQueueFileName srvrfwd1 # set file name, also enables disk mode
$ActionResumeRetryCount -1 # infinite retries on insert failure
$ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down
$ActionQueueMaxDiskSpace 100m # limit disk cache
$ActionQueueTimeoutEnqueue 100 # dont block worker indefinitely when cache
*.* @@loghost:515
This is one option (overflow to disk). Note that if the disk partition that the
spool file is on fills up (100m in your config) the exact same blocking can
happen again.
There are also options for throwing away logs when you get too full, look for
options with 'watermark' in their names.
A couple notes on these options (many people don't understand what's happening
here, they just copy the lines from the examples)
setting an ActionQueueType decouples this action from the main queue. The type
can be any of the allowed types (array is the fastest)
setting a filename on a queue (either the main queue or an action queue) tells
rsyslog that when the queue fills up, spill to disk. Make sure that the user
rsyslog is running as (including after it drops permissions) is able to write to
these files. disk spools are very slow (especially in pre 7.2 versions, they got
a significant improvement at that time)
by setting it to save to disk on shutdown, rsyslog can be slow to shutdown.
David Lang
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
