Re: [rsyslog] rsyslogd buffering logs?

2012-12-18 Thread Rainer Gerhards
> -Original Message- > From: rsyslog-boun...@lists.adiscon.com [mailto:rsyslog- > boun...@lists.adiscon.com] On Behalf Of David Lang > Sent: Tuesday, December 18, 2012 2:22 PM > To: rsyslog-users > Subject: Re: [rsyslog] rsyslogd buffering logs? > > On Tue,

Re: [rsyslog] rsyslogd buffering logs?

2012-12-18 Thread Rainer Gerhards
> -Original Message- > From: rsyslog-boun...@lists.adiscon.com [mailto:rsyslog- > boun...@lists.adiscon.com] On Behalf Of David Lang > Sent: Tuesday, December 18, 2012 2:10 PM > To: rsyslog-users > Subject: Re: [rsyslog] rsyslogd buffering logs? > > On Tue,

Re: [rsyslog] rsyslogd buffering logs?

2012-12-18 Thread David Lang
On Tue, 18 Dec 2012, bodik wrote: #forward1 $ActionQueueType LinkedList# use asynchronous processing $ActionQueueFileName srvrfwd1 # set file name, also enables disk mode $ActionResumeRetryCount -1 # infinite retries on insert failure $ActionQueueSaveOnShutdown on # sav

Re: [rsyslog] rsyslogd buffering logs?

2012-12-18 Thread bodik
>> #forward1 >> $ActionQueueType LinkedList# use asynchronous processing >> $ActionQueueFileName srvrfwd1 # set file name, also enables disk mode >> $ActionResumeRetryCount -1 # infinite retries on insert failure >> $ActionQueueSaveOnShutdown on # save in-memory data if rs

Re: [rsyslog] rsyslogd buffering logs?

2012-12-18 Thread David Lang
On Tue, 18 Dec 2012, bodik wrote: Is that the expected behavior of rsyslog with that configuration ? I believe it is. http://www.rsyslog.com/doc/queues.html Yes. note that this is not a new failure that rsyslog introduces, it's the standard behavior that syslog has had all along. With th

Re: [rsyslog] rsyslogd buffering logs?

2012-12-18 Thread bodik
> Is that the expected behavior of rsyslog with that configuration ? I believe it is. http://www.rsyslog.com/doc/queues.html > How can we configure the TCP action in order to prevent the complete > locking ? http://www.rsyslog.com/doc/rsyslog_reliable_forwarding.html beside what's written the

Re: [rsyslog] rsyslogd buffering logs?

2012-12-18 Thread Philippe Muller
Hello, Trying to understand rsyslog behavior with that sample config: - If loghost.unet.brandeis.edu is down, messages will pile up in the main queue (because the TCP action has a direct queue by default) - Once the main queue is full, rsyslog will no longer poll /dev/log - Now, rsyslog will no lo

Re: [rsyslog] rsyslogd buffering logs?

2012-12-17 Thread David Lang
On Mon, 17 Dec 2012, John Miller wrote: On 12/17/2012 05:02 PM, David Lang wrote: My guess is that something is interrupting the TCP connection and logs then stop (possibly a firewall or NAT timeout), logs are then buffered until something gets restarted and they start flowing again. Right

Re: [rsyslog] rsyslogd buffering logs?

2012-12-17 Thread John Miller
On 12/17/2012 05:02 PM, David Lang wrote: My guess is that something is interrupting the TCP connection and logs then stop (possibly a firewall or NAT timeout), logs are then buffered until something gets restarted and they start flowing again. Right you were! Tested this out by commenting

Re: [rsyslog] rsyslogd buffering logs?

2012-12-17 Thread David Lang
On Mon, 17 Dec 2012, John Miller wrote: Hello everyone, I'm running into a strange problem with some new RHEL 6 servers I've built. I can go for days without anything appearing to get logged (to any file/remote server), but then when I restart rsyslog via the provided initscripts, logs magic

Re: [rsyslog] rsyslogd buffering logs?

2012-12-17 Thread Rainer Gerhards
> boun...@lists.adiscon.com] On Behalf Of John Miller > Sent: Monday, December 17, 2012 10:20 PM > To: rsyslog@lists.adiscon.com > Subject: [rsyslog] rsyslogd buffering logs? > > Hello everyone, > > I'm running into a strange problem with some new RHEL 6 servers I've >

[rsyslog] rsyslogd buffering logs?

2012-12-17 Thread John Miller
Hello everyone, I'm running into a strange problem with some new RHEL 6 servers I've built. I can go for days without anything appearing to get logged (to any file/remote server), but then when I restart rsyslog via the provided initscripts, logs magically appear! Obviously there's some sor