Re: [rsyslog] Correct way to stop rsyslog without losing messages

2020-03-12 Thread Rainer Gerhards via rsyslog
The version from https://www.rsyslog.com/rhelcentos-rpms/ should work (AFIK). Rainer El jue., 12 mar. 2020 a las 15:18, pedro.m.reis via rsyslog () escribió: > > Is there any working version currently for centos8 that I can test? > > > > -- > Sent from: http://rsyslog-users.1305293.n2.nabble.com/

Re: [rsyslog] Correct way to stop rsyslog without losing messages

2020-03-12 Thread pedro.m.reis via rsyslog
Is there any working version currently for centos8 that I can test? -- Sent from: http://rsyslog-users.1305293.n2.nabble.com/ ___ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What'

Re: [rsyslog] Correct way to stop rsyslog without losing messages

2020-03-12 Thread Rainer Gerhards via rsyslog
8.37 is known to have defunct kafka components. Rainer El jue., 12 mar. 2020 a las 15:02, pedro.m.reis via rsyslog () escribió: > > And today, after installing a clean centos8, updated etc, using the base > rsyslog that comes with it (rsyslogd 8.37.0-13.el8, working yesterday), I > have this : >

Re: [rsyslog] Correct way to stop rsyslog without losing messages

2020-03-12 Thread pedro.m.reis via rsyslog
And today, after installing a clean centos8, updated etc, using the base rsyslog that comes with it (rsyslogd 8.37.0-13.el8, working yesterday), I have this : from /var/log/messages Mar 12 13:45:17 x.x.x.com systemd-coredump[9484]: Process 9469 (rsyslogd) of user 0 dumped core.#012#012Stack trace

Re: [rsyslog] Correct way to stop rsyslog without losing messages

2020-03-11 Thread pedro.m.reis via rsyslog
Hi, yes from both the v8-stable and the v8-stable-nightly following this instructions https://www.rsyslog.com/rhelcentos-rpms/ Regards, Pedro -- Sent from: http://rsyslog-users.1305293.n2.nabble.com/ ___ rsyslog mailing list http://lists.adiscon.net/

Re: [rsyslog] Correct way to stop rsyslog without losing messages

2020-03-11 Thread Andre Lorbach via rsyslog
alf Of > pedro.m.reis via rsyslog > Sent: Wednesday, 11 March 2020 11:56 > To: rsyslog@lists.adiscon.com > Cc: pedro.m.reis > Subject: Re: [rsyslog] Correct way to stop rsyslog without losing messages > > Im having some problems activating the imkafka on this version... >

Re: [rsyslog] Correct way to stop rsyslog without losing messages

2020-03-11 Thread pedro.m.reis via rsyslog
And the following. This is a Centos 8 fully updated. Mar 11 13:04:11 itldnnmslog03 systemd[1]: Starting System Logging Service... Mar 11 13:04:11 itldnnmslog03 kernel: rdk:main[8509]: segfault at 59aea ip 7fd2ba60a94f sp 7fd2b7c74be0 error 4 in imkafka.so[7fd2ba59f000+d6000] Mar 11 13:04

Re: [rsyslog] Correct way to stop rsyslog without losing messages

2020-03-11 Thread pedro.m.reis via rsyslog
Im having some problems activating the imkafka on this version... 2790.289223376:main thread: glbl.c: GenerateLocalHostName uses 'itldnnmslog03' 2790.289231207:main thread: ratelimit.c: ratelimit:rsyslogd[dflt]:new ratelimiter:bReduceRepeatMsgs 0 2790.289235557:main thread: ratelimit.

Re: [rsyslog] Correct way to stop rsyslog without losing messages

2020-03-11 Thread pedro.m.reis via rsyslog
Hi Yes I know I have monstrous queues, Im still probing with several configurations and loads. So before rsyslogd starts I have : On Kafka Consumer group 'nms-pit' has no active members. nms-pit syslog-global 0 158036144158425372 389228 - -

Re: [rsyslog] Correct way to stop rsyslog without losing messages

2020-03-10 Thread Rainer Gerhards via rsyslog
El mar., 10 mar. 2020 a las 17:26, pedro.m.reis via rsyslog () escribió: > > Hi, tks > > Ok, I will update this and see how it goes. > For the time it should take to write to disk, assuming that 500.000 messages > (normal syslog messages), how long should it take to write? Ballpark > value... Im us

Re: [rsyslog] Correct way to stop rsyslog without losing messages

2020-03-10 Thread pedro.m.reis via rsyslog
Hi, tks Ok, I will update this and see how it goes. For the time it should take to write to disk, assuming that 500.000 messages (normal syslog messages), how long should it take to write? Ballpark value... Im using a 10G link to an external storage with SSD disks. The storage itself does not have

Re: [rsyslog] Correct way to stop rsyslog without losing messages

2020-03-10 Thread Rainer Gerhards via rsyslog
It's a pretty old version. I think even one with quite some bugs in kafka components. I suggest to current 8.2002.0 and see if the issue persists. You have also quite large queues - if there resides e.g. 500,000 messages in the cee-json-parsed-ok queue, it takes a while to write them out to disk on

Re: [rsyslog] Correct way to stop rsyslog without losing messages

2020-03-10 Thread pedro.m.reis via rsyslog
When I stopped it I get: Mar 10 15:36:03 log03 systemd[1]: Stopping System Logging Service... Mar 10 15:41:03 log03 systemd[1]: rsyslog.service: State 'stop-sigterm' timed out. Killing. Mar 10 15:41:03 log03 systemd[1]: rsyslog.service: Killing process 7986 (rsyslogd) with signal SIGKILL. Mar 10 1

Re: [rsyslog] Correct way to stop rsyslog without losing messages

2020-03-10 Thread pedro.m.reis via rsyslog
rsyslogd -version rsyslogd 8.37.0-13.el8, compiled with: PLATFORM: x86_64-redhat-linux-gnu PLATFORM (lsb_release -d): FEATURE_REGEXP: Yes GSSAPI Kerberos 5 support: Yes FEATURE_DEBUG (debug bu

Re: [rsyslog] Correct way to stop rsyslog without losing messages

2020-03-10 Thread Rainer Gerhards via rsyslog
version? config? Rainer El mar., 10 mar. 2020 a las 16:29, pedro.m.reis via rsyslog () escribió: > > In my use case the rsyslog is consuming from a kafka topic and writing to > disk... So I would expect that it should save the queues to disk and exit. > but it takes several minutes and the proces

Re: [rsyslog] Correct way to stop rsyslog without losing messages

2020-03-10 Thread pedro.m.reis via rsyslog
In my use case the rsyslog is consuming from a kafka topic and writing to disk... So I would expect that it should save the queues to disk and exit. but it takes several minutes and the process is killed by systemd.. -- Sent from: http://rsyslog-users.1305293.n2.nabble.com/ _

Re: [rsyslog] Correct way to stop rsyslog without losing messages

2020-03-10 Thread John Chivian via rsyslog
My experience is that if rsyslog does not stop "quickly", then it is trying to do something like write to a queue file or terminate connectivity with a "slow" network partner.  If you can figure out what it's trying to do you'll be halfway to solving the issue. https://serverfault.com/question

[rsyslog] Correct way to stop rsyslog without losing messages

2020-03-10 Thread pedro.m.reis via rsyslog
Hi all What is the correct way to stop the rsyslog daemon without message loss? I'm having trouble to stop it via systemd, it takes forever and then the process is killed. Cann you provide a sample systemd unit file? Or point me to a thread/web/etc. Thanks Pedro -- Sent from: http://rsyslog-u