Re: [rsyslog] RELP suspendDuration went far too large?
El 14/02/17 a las 16:00, Rainer Gerhards escribió: Search on "debug on demand" should get you useful results. Great! Doing it as we speak! I'd also suggest to review the action () parameters. Anything in particular? there is a setting to have it log suspend messages, that gives you the duration. It's something that goes in the main() section. I'd have to dig to find it though. something like logsuspend=yes DebugOnDemand seems to be perfect, anyway I wasn't able to found what you said. ___ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: [rsyslog] RELP suspendDuration went far too large?
Search on "debug on demand" should get you useful results. I'd also suggest to review the action () parameters. Rage Sent from phone, thus brief. Am 14.02.2017 14:49 schrieb "David Lang" : > On Tue, 14 Feb 2017, mostolog--- via rsyslog wrote: > > This *could* also be related to https://github.com/rsyslog/librelp/pull/54 >>> which I am about to merge soon and which will be released alongside >>> rsyslog >>> 8.25. >>> >> Will test 8.25 and let you know if it's solved. >> >>> >>> there is a setting to have it log suspend messages, that gives you the duration. It's something that goes in the main() section. I'd have to dig to find it though. >>> If you could give me a hint, I could try to guess what you refer by my >> own... >> > > something like logsuspend=yes > > Shall suspendDuration have a maximum value? > I'll open an issue. >> >> just a note, you can define the debug file in the config and then turn debug on and off while running, no overhead when it's off. >>> Do you mean: >> export RSYSLOG_DEBUGLOG="/var/spool/rsyslog/debug.log" >> export RSYSLOG_DEBUG="" >> > > you can do that, or in rsyslog.conf you can define the debug file (again > something in main()) > > David Lang > ___ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > ___ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: [rsyslog] RELP suspendDuration went far too large?
On Tue, 14 Feb 2017, mostolog--- via rsyslog wrote: This *could* also be related to https://github.com/rsyslog/librelp/pull/54 which I am about to merge soon and which will be released alongside rsyslog 8.25. Will test 8.25 and let you know if it's solved. there is a setting to have it log suspend messages, that gives you the duration. It's something that goes in the main() section. I'd have to dig to find it though. If you could give me a hint, I could try to guess what you refer by my own... something like logsuspend=yes Shall suspendDuration have a maximum value? I'll open an issue. just a note, you can define the debug file in the config and then turn debug on and off while running, no overhead when it's off. Do you mean: export RSYSLOG_DEBUGLOG="/var/spool/rsyslog/debug.log" export RSYSLOG_DEBUG="" you can do that, or in rsyslog.conf you can define the debug file (again something in main()) David Lang ___ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: [rsyslog] RELP suspendDuration went far too large?
This *could* also be related to https://github.com/rsyslog/librelp/pull/54 which I am about to merge soon and which will be released alongside rsyslog 8.25. Will test 8.25 and let you know if it's solved. there is a setting to have it log suspend messages, that gives you the duration. It's something that goes in the main() section. I'd have to dig to find it though. If you could give me a hint, I could try to guess what you refer by my own... Shall suspendDuration have a maximum value? I'll open an issue. just a note, you can define the debug file in the config and then turn debug on and off while running, no overhead when it's off. Do you mean: export RSYSLOG_DEBUGLOG="/var/spool/rsyslog/debug.log" export RSYSLOG_DEBUG="" Thanks ___ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: [rsyslog] RELP suspendDuration went far too large?
This *could* also be related to https://github.com/rsyslog/librelp/pull/54 which I am about to merge soon and which will be released alongside rsyslog 8.25. Rainer 2017-02-14 13:22 GMT+01:00 David Lang : > On Tue, 14 Feb 2017, mostolog--- via rsyslog wrote: > > While using RELP to forward messages to a central rsyslog, we had a full >> disk issue on target. >> >> After cleaning the disk and recovering space, relay rsyslog seems is not >> forwarding traffic as it should (full speed!). >> >> Messages with priority 12 still arrive, and impstats shows: >> >> Feb 14 11:22:21 relay rsyslogd-pstats: fwdtocentral: origin=core.queue >> size=90 enqueued=107845543 full=0 discarded.full=0 discarded.nf=41435274 >> maxqsize=90138 >> >> >> Could it be suspendDuration went too high after 2 days with high >> traffic(60k/min)? >> > > possible > > Is there any way to query suspendDuration value while running? (without >> DEBUG!) >> > > there is a setting to have it log suspend messages, that gives you the > duration. It's something that goes in the main() section. I'd have to dig > to find it though. > > Does it suspendDuration gets decreased when connection is recovered? (I >> won't say that after reading action.c) >> >> Shall suspendDuration have a maximum value? >> > > if it doesn't, it should > > Will HUP signal reset suspendDuration and start forwarding normally? >> > > I believe so, because the HUP will close all outputs and restart them on > the next message > > Is there anything I could test to help fixing this (if it's a bug)? >> > > just a note, you can define the debug file in the config and then turn > debug on and off while running, no overhead when it's off. > > David Lang > > ___ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > ___ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: [rsyslog] RELP suspendDuration went far too large?
On Tue, 14 Feb 2017, mostolog--- via rsyslog wrote: While using RELP to forward messages to a central rsyslog, we had a full disk issue on target. After cleaning the disk and recovering space, relay rsyslog seems is not forwarding traffic as it should (full speed!). Messages with priority 12 still arrive, and impstats shows: Feb 14 11:22:21 relay rsyslogd-pstats: fwdtocentral: origin=core.queue size=90 enqueued=107845543 full=0 discarded.full=0 discarded.nf=41435274 maxqsize=90138 Could it be suspendDuration went too high after 2 days with high traffic(60k/min)? possible Is there any way to query suspendDuration value while running? (without DEBUG!) there is a setting to have it log suspend messages, that gives you the duration. It's something that goes in the main() section. I'd have to dig to find it though. Does it suspendDuration gets decreased when connection is recovered? (I won't say that after reading action.c) Shall suspendDuration have a maximum value? if it doesn't, it should Will HUP signal reset suspendDuration and start forwarding normally? I believe so, because the HUP will close all outputs and restart them on the next message Is there anything I could test to help fixing this (if it's a bug)? just a note, you can define the debug file in the config and then turn debug on and off while running, no overhead when it's off. David Lang ___ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
[rsyslog] RELP suspendDuration went far too large?
Hi While using RELP to forward messages to a central rsyslog, we had a full disk issue on target. After cleaning the disk and recovering space, relay rsyslog seems is not forwarding traffic as it should (full speed!). Messages with priority 12 still arrive, and impstats shows: Feb 14 11:22:21 relay rsyslogd-pstats: fwdtocentral: origin=core.queue size=90 enqueued=107845543 full=0 discarded.full=0 discarded.nf=41435274 maxqsize=90138 Could it be suspendDuration went too high after 2 days with high traffic(60k/min)? Is there any way to query suspendDuration value while running? (without DEBUG!) Does it suspendDuration gets decreased when connection is recovered? (I won't say that after reading action.c) Shall suspendDuration have a maximum value? Will HUP signal reset suspendDuration and start forwarding normally? Is there anything I could test to help fixing this (if it's a bug)? Regards ___ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
