2

I have syslog successfully forwarding logs to an upstream server like so:

$MainMsgQueyeType LinkedList
$MainMsgQueueSize 10000
$MainMsgQueusDiscardMark 8000
$MainMsgQueueDiscardSeverity 1
$MainMsgQueueSaveOnShutdown off
$MainMsgQueueTimeoutEnqueue 0

$ActionQueueType LinkedList    # in memory queue
$ActionQueueFileName fwdRule1  # unique name prefix for spool files
$ActionQueueSize 10000         # Only allow 10000 elements in the queue
$ActionQueueDiscardMark 8000   # Only allow 8000 elements in the queue before dropping msgs
$ActionQueueDiscardSeverity 1  # Discard Alert,Critical,Error,Warning,Notice,Info,Debug, NOT Emergency
$ActionQueueSaveOnShutdown off # save messages to disk on shutdown
$ActionQueueTimeoutEnqueue 0
$ActionResumeRetryCount -1     # infinite retries if host is down

$RepeatedMsgReduction off

*.* @@remoteserver.mynetwork.com:5544

On the remoteserver I have something that talks syslog and listens on that port. To test, I have a simple log client that logs 100 messages a second to syslog.

This all works fine, and I have configured the queues above so that in the event that the remoteserver is unavailable, the queues start filling up, and then eventually messages get discarded, thus safeguarding syslog from blocking its logging clients.

When I stop the remote log sink on remoteserver:5544, syslog is still stable (queues filling up / full up), but when I restart the remote log sink a while later, rsyslog detects the server again, reestablishes a TCP connection

HOWEVER - syslog only forwards 1 message to it, despite the queue having many thousands of messages in it, and the logging client continuing to log 100 messages a second

How can I make syslog start forwarding messages again once it has detected the remoteserver is back up? (Without restarting syslog).

Am using rsyslog 4.6.2-2

I am using, and want to use TCP

4

1 回答 1

5

万一有人遇到这个问题，工作目录被设置为：

$WorkDirectory /var/spool/rsyslog

而上面的配置，这样做：

$ActionQueueFileName fwdRule1

即使它应该是一个内存队列。因此，当队列达到 800（奇怪的是，不是 8000）时，磁盘辅助模式被激活，并且 syslog 尝试将消息写入 /var/spool/rsyslog。该目录不存在。随机地，（因此必须存在竞争条件和 rsyslog 中的错误），在不断尝试打开该目录中磁盘上的队列文件后，rsyslog 进入扭曲状态并放弃并继续排队消息，直到达到最高值10,000 马克。重启下游 logserver 未能使其恢复。

取出对 ActionQueueFileName 的所有引用并使 WorkDirectory 存在修复了此问题。

于 2013-11-01T18:48:43.917 回答