I'm running rsyslog 8.4.2 on ubuntu 12.04 (freshly compiled). I'm losing the
first log line after a tcp connection is reset, and can replicate it with these
steps. The same config with version 7.4.5 worked flawlessly:
Test case:
* rsyslogd 8.4.2 running with omfwd configured to send to localhost:5544
over tcp.
* netcat listening to port 5544 (nc -l 5544)
* start rsyslogd
* send message. Successfully sent, netcat displays it.
* stop netcat.
* netcat sends a FIN, rsyslog ACK's it. Connection goes into CLOSE_WAIT
state forever (well until I send another message and force rsyslog to
reconnect, but > 10 minutes if I wait)
* start netcat.
* send another message.
* rsyslog sends a FIN packet, netcat acks. Then rsyslog builds the TCP
connection but sends nothing. Message is lost forever.
* send another message, goes through successfully (as does every subsequent
message)
The output from rsyslogd in debug mode shows this sequence of events
(customerstreamserver is the name of my action)
1858.496126807:customerstreamserver queue:Reg/w0: omfwd: add 224 bytes to send
buffer (curr offs 0)
1858.496130718:customerstreamserver queue:Reg/w0: omfwd: endTransaction,
offsSndBuf 224, iRet -2121
1858.496137143:customerstreamserver queue:Reg/w0: CheckConnection detected
broken connection - closing it
1858.496287716:customerstreamserver queue:Reg/w0: TCPSendBuf error -2027,
destruct TCP Connection!
1858.496300567:customerstreamserver queue:Reg/w0: file netstrms.c released
module 'lmnsd_ptcp', reference count now 2
1858.496305316:customerstreamserver queue:Reg/w0: Action 16 transitioned to
state: rtry
1858.496312020:customerstreamserver queue:Reg/w0: actionDoRetry:
customerstreamserver enter loop, iRetries=0
1858.496315931:customerstreamserver queue:Reg/w0: DDDD: tryResume: pWrkrData
0x7f83fc0022b0
1858.496319563:customerstreamserver queue:Reg/w0: localhost
1858.496323753:customerstreamserver queue:Reg/w0: TCPSendInit CREATE
1858.496329620:customerstreamserver queue:Reg/w0: source file netstrms.c
requested reference for module 'lmnsd_ptcp', reference count now 3
1858.496668479:customerstreamserver queue:Reg/w0: actionDoRetry:
customerstreamserver action->tryResume returned 0
1858.496673786:customerstreamserver queue:Reg/w0: actionDoRetry:
customerstreamserver had success RDY again (iRet=0)
1858.496684123:customerstreamserver queue:Reg/w0: Called LogMsg, msg: action
'customerstreamserver' resumed (module 'builtin:omfwd')
1858.496695017:customerstreamserver queue:Reg/w0: main Q: qqueueAdd: entry
added, size now log 1, phys 1 entries
Config for the action is as follows:
ruleset(name="customerstreamserver") {
#ignore template stuff
action(type="omfwd"
name="customerstreamserver"
target="localhost"
port="5544"
protocol="tcp"
template="LongTagForwardFormat"
queue.filename="customerstreamserver"
queue.maxdiskspace="2147483648"
queue.saveonshutdown="on"
queue.type="LinkedList"
queue.size="4000000"
queue.highwatermark="1000000"
queue.lowwatermark="900000"
queue.discardmark="3600000"
queue.discardseverity="4"
queue.timeoutenqueue="0"
action.resumeretrycount="-1"
action.resumeinterval="1"
action.reportSuspension="on"
action.reportSuspensionContinuation="on"
)
stop
}
input(type="imudp" port="1514" ruleset="customerstreamserver")
input(type="imtcp" port="1514" ruleset="customerstreamserver")
Any ideas?
Thanks
mike
--
Michael Hart
Arctic Wolf Networks
M: 226-388-4773
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
