Hi David, I found out that ompipe was discarding a few messages when pipe was full due to action resume logic.
It seems that commit below resolved the issue. https://github.com/rsyslog/rsyslog/commit/59627f23bee26f3acec19d491d5884bcd1fb672e Thanks. On Tue, Jul 24, 2018 at 1:39 AM David Lang <[email protected]> wrote: > not in order with disk based queues is expected, missing is not > > can you enable impstats with a nice short reporting interval so that it > can get > several datapoints during your test? > > also look in your log messages for syspended/resumed messages. > > It's also far better to use the action() syntax when you have more complex > configs like this, it makes it much clearer as to exactly what's going on. > > David Lang > > On Mon, 23 Jul 2018, Radovan Sroka via rsyslog wrote: > > > Date: Mon, 23 Jul 2018 21:16:32 +0200 > > From: Radovan Sroka via rsyslog <[email protected]> > > To: "[email protected]" <[email protected]> > > Cc: Radovan Sroka <[email protected]> > > Subject: [rsyslog] ompipe bug? > > > > Hi rsyslog-comunity, > > > > I have this snippet at the and of the default CentOS7 rsyslog.conf. > > > > $ActionQueueFileName pipeRule1 > > $ActionQueueMaxDiskSpace 1g > > $ActionQueueSaveOnShutdown on > > $ActionQueueType LinkedList > > $ActionResumeRetryCount -1 > > local6.* |/opt/alarmfifo > > > > Let's say I have script that sends 2000 messages with local6.error > > priority. I will send them several times and after that I will "cat" that > > pipe or read it somehow. When I check the messages, some are missing or > > they are not in order. > > > > Is this expected? > > > > I added two scripts. The first one is generating messages and the second > > one is checking the continuity or discontinuity. > > > > > > Actual results (when messages are queued): > > perl discontinuity.pl -c -i /opt/alarmfifo > > > > Starting sequence at 1 > > paused at 866 > > Discontinuity: 866 -> 870 > > resumed 870 > > paused at 1720 > > Discontinuity: 1720 -> 868 > > resumed 868 > > Discontinuity: 868 -> 1365 > > paused at 2000 > > Discontinuity: 2000 -> 1722 > > resumed 1722 > > Discontinuity: 2000 -> 1 > > paused at 582 > > Discontinuity: 582 -> 584 > > resumed 584 > > paused at 1364 > > > > > > In case of instant reading of pipe the output looks OK. > > > > Starting sequence at 1 > > paused at 2000 > > Discontinuity: 2000 -> 1 > > resumed 1 > > paused at 2000 > > Discontinuity: 2000 -> 1 > > resumed 1 > > paused at 2000 > > > > > -- -- --------------------------------------------------------- Radovan Sroka Associate Software Engineer | Security Technologies | Red hat, Inc. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
