--On Sunday, May 04, 2014 04:03:55 PM -0700 David Lang <[email protected]> wrote:
On Sun, 4 May 2014, Bill MacAllister wrote:
I need some help understanding how to control queue behaviour. The
goal is to write messages to a file locally and also forward the
messages to a remote rsyslog server. When the remote server is
unavailable I would like message to queue up and be processed when the
server is available again. I have a configuration that works this way
but has the unwanted side-effect that both local and forwarded
messages are being help until the remote server is available again. Here
is a configuration fragment.
*.debug action(type="omfile"
file="/var/log/messages"
template="FileFormat")
*.debug action(type="omfwd"
Target="logsink-dev.stanford.edu"
Port="10514"
Protocol="tcp"
queue.FileName="default_queue"
queue.size="4000000"
queue.HighWaterMark="100000"
queue.LowWaterMark="10000"
queue.MaxDiskSpace="2g"
queue.WorkerThreads="10"
queue.TimeoutEnqueue="120000"
action.ResumeRetryCount="-1"
template="ForwardFormat")
In this configuration there are three queues: the main queue, the
queue for the omfile action and the queue for the omfwd action.
Right?
I don't see any queue for the omfile action, so I think you just
have two queues, the main queue and the omfwd queue
Oh, right. During some of my testing I had queue.type="direct", but
that didn't see to change the behaviour at all.
Why does the omfwd queue block the omfile queue? What am I
misunderstanding?
the omfwd queue should only block the main queue if it fills up
enable impstats and look at what happens to the queue sizes and
activity as you block the TCP connection
Here is my a sample test sequence of steps that I am using.
1. Here is a tail of syslog output from local system with pstats
output.
2014-05-04T19:06:32.206331-07:00 zoot-vm1 rsyslogd-pstats: imuxsock:
submitted=2122 ratelimit.discarded=0 ratelimit.numratelimiters=2074
2014-05-04T19:06:32.206349-07:00 zoot-vm1 rsyslogd-pstats: action 1:
processed=0 failed=0
2014-05-04T19:06:32.206353-07:00 zoot-vm1 rsyslogd-pstats: action 2:
processed=4299 failed=0
2014-05-04T19:06:32.206357-07:00 zoot-vm1 rsyslogd-pstats: action 3:
processed=4299 failed=0
2014-05-04T19:06:32.206360-07:00 zoot-vm1 rsyslogd-pstats: action 4:
processed=0 failed=0
2014-05-04T19:06:32.206362-07:00 zoot-vm1 rsyslogd-pstats: pstats:
processed=2176 failed=0
2014-05-04T19:06:32.206366-07:00 zoot-vm1 rsyslogd-pstats: pstats: size=0
enqueued=2176 full=0 discarded.full=0 discarded.nf=0 maxqsize=8
2014-05-04T19:06:32.206368-07:00 zoot-vm1 rsyslogd-pstats: main Q: size=7
enqueued=4306 full=0 discarded.full=0 discarded.nf=0 maxqsize=8
2. Stop rsyslog on remote system.
3. Generate several thousand syslog messages on local system using
logger.
4. The 'tail -f' on the local system records the first of the test
messages from the test and then stalls.
2014-05-04T19:06:58.861431-07:00 zoot-vm1 whm: This is Testmessage #0
5. Start rsyslog on remote system and a bit later all test messages show
up on both local and remote system. Below is the pstats output from
the system right after all of the test messages are delivered.
2014-05-04T19:07:32.266456-07:00 zoot-vm1 rsyslogd-pstats: imuxsock:
submitted=5122 ratelimit.discarded=0 ratelimit.numratelimiters=5073
2014-05-04T19:07:32.266470-07:00 zoot-vm1 rsyslogd-pstats: action 1:
processed=0 failed=0
2014-05-04T19:07:32.266474-07:00 zoot-vm1 rsyslogd-pstats: action 2:
processed=4308 failed=0
2014-05-04T19:07:32.266478-07:00 zoot-vm1 rsyslogd-pstats: action 3:
processed=4308 failed=0
2014-05-04T19:07:32.266481-07:00 zoot-vm1 rsyslogd-pstats: action 4:
processed=0 failed=0
2014-05-04T19:07:32.266484-07:00 zoot-vm1 rsyslogd-pstats: pstats:
processed=2184 failed=0
2014-05-04T19:07:32.266487-07:00 zoot-vm1 rsyslogd-pstats: pstats: size=0
enqueued=2184 full=0 discarded.full=0 discarded.nf=0 maxqsize=8
2014-05-04T19:07:32.266491-07:00 zoot-vm1 rsyslogd-pstats: main Q: size=3007
enqueued=7314 full=0 discarded.full=0 discarded.nf=0 maxqsize=3007
2014-05-04T19:08:32.326566-07:00 zoot-vm1 rsyslogd-pstats: imuxsock:
submitted=5122 ratelimit.discarded=0 ratelimit.numratelimiters=5073
2014-05-04T19:08:32.326577-07:00 zoot-vm1 rsyslogd-pstats: action 1:
processed=0 failed=0
2014-05-04T19:08:32.326580-07:00 zoot-vm1 rsyslogd-pstats: action 2:
processed=7315 failed=0
2014-05-04T19:08:32.326583-07:00 zoot-vm1 rsyslogd-pstats: action 3:
processed=7315 failed=0
2014-05-04T19:08:32.326586-07:00 zoot-vm1 rsyslogd-pstats: action 4:
processed=0 failed=0
2014-05-04T19:08:32.326588-07:00 zoot-vm1 rsyslogd-pstats: pstats:
processed=2192 failed=0
2014-05-04T19:08:32.326591-07:00 zoot-vm1 rsyslogd-pstats: pstats: size=0
enqueued=2192 full=0 discarded.full=0 discarded.nf=0 maxqsize=8
2014-05-04T19:08:32.326594-07:00 zoot-vm1 rsyslogd-pstats: main Q: size=7
enqueued=7322 full=0 discarded.full=0 discarded.nf=0 maxqsize=3008
Bill
--
Bill MacAllister
Systems Programmer, Stanford University
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
