Re: [rsyslog] How is the imrelp MaxDataSize parameter related to the global() maxMessageSize parameter?
Thanks for reply. In my case, the problem seemed to resolve itself once I set the MaxDataSize parameter for imprelp (previously unset, now 128k) to the same value as global.maxmessagesize (128k as listed below). Are those two parameters related? With the explicit setting of the MaxDataSize parameter messages that were previously "stuck", flow once more. On 10/29/2017 1:22 PM, Rainer Gerhards wrote: quick answer: I guess you ran into this https://github.com/rsyslog/rsyslog/issues/1741 Let me know if more info is needed. Rainer 2017-10-29 19:15 GMT+01:00 deoren : I originally sent this as part of another thread, but I think this got buried and lost among the noise the rest of my notes generated. Posting a cleaner version here in case others know the answer. I'm trying to avoid using legacy configuration options where I can, but just in case the order of the configuration settings matters, I've set the maxMessageSize global parameter prior to loading the imrelp module and the configuring the imrelp input. I should note that the sending system and the receiving system both have the exact same collection of global() object parameters and values. Illustration: ### global ( maxMessageSize="128k" action.reportSuspension="on" action.reportSuspensionContinuation="on" workDirectory="/var/spool/rsyslog" processInternalMessages="off" parser.permitSlashInProgramName="on" ) # more config settings here ... input( type="imrelp" port="2514" KeepAlive="on" ruleset="receiver-rsyslog-JSON-payload-parsing" ) ### Even so, the maxMessageSize parameter value did not seem to be used by the imrelp input; the client debug log showed repeat retries to send queued messages. Since I explicitly configured MaxDataSize on the imrelp input I've not seen this problem reoccur: ### global ( maxMessageSize="128k" action.reportSuspension="on" action.reportSuspensionContinuation="on" workDirectory="/var/spool/rsyslog" processInternalMessages="off" parser.permitSlashInProgramName="on" ) # more config settings here ... input( type="imrelp" port="2514" KeepAlive="on" ruleset="receiver-rsyslog-JSON-payload-parsing" MaxDataSize="128k" ) ### Reading over the documentation for imrelp, I found this: MaxDataSize Default is the global message size Sets the max message size (in bytes) that can be received. Any messages above this size will be rejected causing the relp client to reconnect and retry. The "reconnect and retry" sounds exactly like what I'm experiencing, though there isn't anything in the non-debug log which indicates that and I'm not familiar enough with the debug format to be comfortable saying that what I'm experiencing is exactly what is happening. This bit gives me the impression that the default global() maxMessageSize parameter is what imrelp uses unless the MaxDataSize parameter is specifically set. Default is the global message size Is that true or are those values separate? Are they intended for different purposes? Are they separate, but loosely related? refs: https://github.com/rsyslog/rsyslog/issues/1782 ___ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. ___ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. ___ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: [rsyslog] How is the imrelp MaxDataSize parameter related to the global() maxMessageSize parameter?
quick answer: I guess you ran into this https://github.com/rsyslog/rsyslog/issues/1741 Let me know if more info is needed. Rainer 2017-10-29 19:15 GMT+01:00 deoren : > I originally sent this as part of another thread, but I think this got > buried and lost among the noise the rest of my notes generated. Posting a > cleaner version here in case others know the answer. > > > I'm trying to avoid using legacy configuration options where I can, but just > in case the order of the configuration settings matters, I've set the > maxMessageSize global parameter prior to loading the imrelp module and the > configuring the imrelp input. I should note that the sending system and the > receiving system both have the exact same collection of global() object > parameters and values. > > Illustration: > > > ### > global ( > maxMessageSize="128k" > action.reportSuspension="on" > action.reportSuspensionContinuation="on" > workDirectory="/var/spool/rsyslog" > processInternalMessages="off" > parser.permitSlashInProgramName="on" > ) > > # more config settings here ... > > input( > type="imrelp" > port="2514" > KeepAlive="on" > ruleset="receiver-rsyslog-JSON-payload-parsing" > ) > ### > > > > Even so, the maxMessageSize parameter value did not seem to be used by the > imrelp input; the client debug log showed repeat retries to send queued > messages. > > Since I explicitly configured MaxDataSize on the imrelp input I've not seen > this problem reoccur: > > ### > global ( > maxMessageSize="128k" > action.reportSuspension="on" > action.reportSuspensionContinuation="on" > workDirectory="/var/spool/rsyslog" > processInternalMessages="off" > parser.permitSlashInProgramName="on" > ) > > # more config settings here ... > > input( > type="imrelp" > port="2514" > KeepAlive="on" > ruleset="receiver-rsyslog-JSON-payload-parsing" > MaxDataSize="128k" > ) > ### > > > Reading over the documentation for imrelp, I found this: > >> MaxDataSize >> Default is the global message size >> >> Sets the max message size (in bytes) that can be received. Any messages >> above this size will be rejected causing the relp client to reconnect and >> retry. > > The "reconnect and retry" sounds exactly like what I'm experiencing, though > there isn't anything in the non-debug log which indicates that and I'm not > familiar enough with the debug format to be comfortable saying that what I'm > experiencing is exactly what is happening. > > This bit gives me the impression that the default global() maxMessageSize > parameter is what imrelp uses unless the MaxDataSize parameter is > specifically set. > >> Default is the global message size > > Is that true or are those values separate? Are they intended for different > purposes? Are they separate, but loosely related? > > refs: https://github.com/rsyslog/rsyslog/issues/1782 > ___ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. ___ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
[rsyslog] How is the imrelp MaxDataSize parameter related to the global() maxMessageSize parameter?
I originally sent this as part of another thread, but I think this got buried and lost among the noise the rest of my notes generated. Posting a cleaner version here in case others know the answer. I'm trying to avoid using legacy configuration options where I can, but just in case the order of the configuration settings matters, I've set the maxMessageSize global parameter prior to loading the imrelp module and the configuring the imrelp input. I should note that the sending system and the receiving system both have the exact same collection of global() object parameters and values. Illustration: ### global ( maxMessageSize="128k" action.reportSuspension="on" action.reportSuspensionContinuation="on" workDirectory="/var/spool/rsyslog" processInternalMessages="off" parser.permitSlashInProgramName="on" ) # more config settings here ... input( type="imrelp" port="2514" KeepAlive="on" ruleset="receiver-rsyslog-JSON-payload-parsing" ) ### Even so, the maxMessageSize parameter value did not seem to be used by the imrelp input; the client debug log showed repeat retries to send queued messages. Since I explicitly configured MaxDataSize on the imrelp input I've not seen this problem reoccur: ### global ( maxMessageSize="128k" action.reportSuspension="on" action.reportSuspensionContinuation="on" workDirectory="/var/spool/rsyslog" processInternalMessages="off" parser.permitSlashInProgramName="on" ) # more config settings here ... input( type="imrelp" port="2514" KeepAlive="on" ruleset="receiver-rsyslog-JSON-payload-parsing" MaxDataSize="128k" ) ### Reading over the documentation for imrelp, I found this: > MaxDataSize > Default is the global message size > > Sets the max message size (in bytes) that can be received. Any messages above this size will be rejected causing the relp client to reconnect and retry. The "reconnect and retry" sounds exactly like what I'm experiencing, though there isn't anything in the non-debug log which indicates that and I'm not familiar enough with the debug format to be comfortable saying that what I'm experiencing is exactly what is happening. This bit gives me the impression that the default global() maxMessageSize parameter is what imrelp uses unless the MaxDataSize parameter is specifically set. > Default is the global message size Is that true or are those values separate? Are they intended for different purposes? Are they separate, but loosely related? refs: https://github.com/rsyslog/rsyslog/issues/1782 ___ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
