Re: [rsyslog] Correct way to stop rsyslog without losing messages

2020-03-10 Thread Rainer Gerhards via rsyslog
El mar., 10 mar. 2020 a las 17:26, pedro.m.reis via rsyslog () escribió: > > Hi, tks > > Ok, I will update this and see how it goes. > For the time it should take to write to disk, assuming that 500.000 messages > (normal syslog messages), how long should it take to write? Ballpark > value... Im us

Re: [rsyslog] Correct way to stop rsyslog without losing messages

2020-03-10 Thread pedro.m.reis via rsyslog
Hi, tks Ok, I will update this and see how it goes. For the time it should take to write to disk, assuming that 500.000 messages (normal syslog messages), how long should it take to write? Ballpark value... Im using a 10G link to an external storage with SSD disks. The storage itself does not have

Re: [rsyslog] Correct way to stop rsyslog without losing messages

2020-03-10 Thread Rainer Gerhards via rsyslog
It's a pretty old version. I think even one with quite some bugs in kafka components. I suggest to current 8.2002.0 and see if the issue persists. You have also quite large queues - if there resides e.g. 500,000 messages in the cee-json-parsed-ok queue, it takes a while to write them out to disk on

Re: [rsyslog] Correct way to stop rsyslog without losing messages

2020-03-10 Thread pedro.m.reis via rsyslog
When I stopped it I get: Mar 10 15:36:03 log03 systemd[1]: Stopping System Logging Service... Mar 10 15:41:03 log03 systemd[1]: rsyslog.service: State 'stop-sigterm' timed out. Killing. Mar 10 15:41:03 log03 systemd[1]: rsyslog.service: Killing process 7986 (rsyslogd) with signal SIGKILL. Mar 10 1

Re: [rsyslog] Correct way to stop rsyslog without losing messages

2020-03-10 Thread pedro.m.reis via rsyslog
rsyslogd -version rsyslogd 8.37.0-13.el8, compiled with: PLATFORM: x86_64-redhat-linux-gnu PLATFORM (lsb_release -d): FEATURE_REGEXP: Yes GSSAPI Kerberos 5 support: Yes FEATURE_DEBUG (debug bu

Re: [rsyslog] Correct way to stop rsyslog without losing messages

2020-03-10 Thread Rainer Gerhards via rsyslog
version? config? Rainer El mar., 10 mar. 2020 a las 16:29, pedro.m.reis via rsyslog () escribió: > > In my use case the rsyslog is consuming from a kafka topic and writing to > disk... So I would expect that it should save the queues to disk and exit. > but it takes several minutes and the proces

Re: [rsyslog] Correct way to stop rsyslog without losing messages

2020-03-10 Thread pedro.m.reis via rsyslog
In my use case the rsyslog is consuming from a kafka topic and writing to disk... So I would expect that it should save the queues to disk and exit. but it takes several minutes and the process is killed by systemd.. -- Sent from: http://rsyslog-users.1305293.n2.nabble.com/ _

Re: [rsyslog] Correct way to stop rsyslog without losing messages

2020-03-10 Thread John Chivian via rsyslog
My experience is that if rsyslog does not stop "quickly", then it is trying to do something like write to a queue file or terminate connectivity with a "slow" network partner.  If you can figure out what it's trying to do you'll be halfway to solving the issue. https://serverfault.com/question

[rsyslog] Correct way to stop rsyslog without losing messages

2020-03-10 Thread pedro.m.reis via rsyslog
Hi all What is the correct way to stop the rsyslog daemon without message loss? I'm having trouble to stop it via systemd, it takes forever and then the process is killed. Cann you provide a sample systemd unit file? Or point me to a thread/web/etc. Thanks Pedro -- Sent from: http://rsyslog-u