Re: [rsyslog] Lost messages after server restart? (using RELP)

2014-01-18 Thread Assaf Gordon
On 01/18/2014 04:30 AM, Rainer Gerhards wrote: On Sat, Jan 18, 2014 at 12:44 AM, Assaf Gordon wrote: Client side: -- module(load="imuxsock" SysSock.Use="off") module(load="omrelp") input(type="imuxsock" Socket="/tmp/client.sock" CreatePath="on") action(type="omrelp" target="1.2.3.4" port="2051

Re: [rsyslog] Lost messages after server restart? (using RELP)

2014-01-18 Thread Rainer Gerhards
On Sat, Jan 18, 2014 at 12:44 AM, Assaf Gordon wrote: > Hello David, > > > On 01/17/2014 06:15 PM, David Lang wrote: > >> On Fri, 17 Jan 2014, Assaf Gordon wrote: >> >> BUT, >>> If I understood the idea behind "RELP" correctly, the client-side >>> "rsyslogd" should know and detect that those mes

Re: [rsyslog] Lost messages after server restart? (using RELP)

2014-01-17 Thread Assaf Gordon
Hello David, On 01/17/2014 06:15 PM, David Lang wrote: On Fri, 17 Jan 2014, Assaf Gordon wrote: BUT, If I understood the idea behind "RELP" correctly, the client-side "rsyslogd" should know and detect that those messages were not ACK'd, hence not delivered. your understanding matches mine th

Re: [rsyslog] Lost messages after server restart? (using RELP)

2014-01-17 Thread David Lang
On Fri, 17 Jan 2014, Assaf Gordon wrote: David, Thank you for the detailed explanation. I think I'm in a simpler situation, which does not require the additional protection you've listed. On 01/17/2014 05:48 PM, David Lang wrote: On Fri, 17 Jan 2014, Assaf Gordon wrote: now, with all of th

Re: [rsyslog] Lost messages after server restart? (using RELP)

2014-01-17 Thread Assaf Gordon
David, Thank you for the detailed explanation. I think I'm in a simpler situation, which does not require the additional protection you've listed. On 01/17/2014 05:48 PM, David Lang wrote: On Fri, 17 Jan 2014, Assaf Gordon wrote: now, with all of this said, let's get back to your situation a

Re: [rsyslog] Lost messages after server restart? (using RELP)

2014-01-17 Thread David Lang
On Fri, 17 Jan 2014, Assaf Gordon wrote: Hello, On 01/17/2014 04:35 PM, David Lang wrote: RELP will prevent logs from being lost in transit, but if the log arrived on the server, but was in the queue when rsyslog was killed, and rsyslog didn't have time to write it out, you can still loose thi

Re: [rsyslog] Lost messages after server restart? (using RELP)

2014-01-17 Thread Assaf Gordon
On 01/17/2014 04:57 PM, Radu Gheorghe wrote: I think the most probable cause is that the lost messages were in the in-memory queue, which got wiped during restart. To fix that, you'd have to make it disk-assisted and set queue.saveonshutdown to yes. I think you'll find the details in those two li

Re: [rsyslog] Lost messages after server restart? (using RELP)

2014-01-17 Thread Assaf Gordon
Hello, On 01/17/2014 04:35 PM, David Lang wrote: RELP will prevent logs from being lost in transit, but if the log arrived on the server, but was in the queue when rsyslog was killed, and rsyslog didn't have time to write it out, you can still loose things. how did you kill the rsyslog receiver

Re: [rsyslog] Lost messages after server restart? (using RELP)

2014-01-17 Thread Radu Gheorghe
I think the most probable cause is that the lost messages were in the in-memory queue, which got wiped during restart. To fix that, you'd have to make it disk-assisted and set queue.saveonshutdown to yes. I think you'll find the details in those two links: http://www.rsyslog.com/doc/queues.html ht

Re: [rsyslog] Lost messages after server restart? (using RELP)

2014-01-17 Thread David Lang
RELP will prevent logs from being lost in transit, but if the log arrived on the server, but was in the queue when rsyslog was killed, and rsyslog didn't have time to write it out, you can still loose things. how did you kill the rsyslog receiver? what does your config look like? (how much stu

[rsyslog] Lost messages after server restart? (using RELP)

2014-01-17 Thread Assaf Gordon
Hello, I've setup rsyslogd (version 7.5.8) with RELP and TLS on two machines (one server, one client). For testing purposes, I've sent repeated messages from the client to the server, but killed and restarted the server during those messages. The result is that I've lost some messages, despi