Mailing List Archive

Hi Mikel,

which version are you using? The "ssh hang" can probably be related to
the initial thought that imuxsock messages can be delayed. This has been
changed in recent releases.

Other than that, please note that actions are retried in intervals and
these intervals get longer each time the action is retried without
success. This is done in order to save unnecessary work. I think there
currently is no config setting to change the default intervals.

It may be useful to get a shutdown debug log from such an occurrence.

Rainer

> -----Original Message-----
> From: rsyslog-bounces@lists.adiscon.com [mailto:rsyslog-
> bounces@lists.adiscon.com] On Behalf Of Mikel Jimenez
> Sent: Wednesday, November 26, 2008 4:25 PM
> To: rsyslog-users
> Subject: [rsyslog] rsyslog freeze dude
>
> Hello
> If I configure rsyslog client like this:
>
> WorkDirectory /root/rsyslog
> $ActionQueueType LinkedList
> $ActionQueueFileName myfile
> $ActionResumeRetryCount -1
>
> and
>
> *.* @@somehost.domain.com
>
> Is possible that lost of conectivity (internet down) of this server
> during days, produce that server freeze? or not be possible to login
to
> the machine?
>
> If I do /etc/init.d/rsyslog restart it takes long long time to
restart.
>
> Please Rainer I hope you help me. thanks
>
>
> --
> Mikel Jimenez Fernandez
> Irontec, Internet y Sistemas sobre GNU/LinuX - http://www.irontec.com
> +34 94.404.81.82
>
>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com

Rainer Gerhards escribió:
> Hi Mikel,
>
> which version are you using? The "ssh hang" can probably be related to
> the initial thought that imuxsock messages can be delayed. This has been
> changed in recent releases.
>
> Other than that, please note that actions are retried in intervals and
> these intervals get longer each time the action is retried without
> success. This is done in order to save unnecessary work. I think there
> currently is no config setting to change the default intervals.
>
> It may be useful to get a shutdown debug log from such an occurrence.
>
> Rainer
>
>
>> -----Original Message-----
>> From: rsyslog-bounces@lists.adiscon.com [mailto:rsyslog-
>> bounces@lists.adiscon.com] On Behalf Of Mikel Jimenez
>> Sent: Wednesday, November 26, 2008 4:25 PM
>> To: rsyslog-users
>> Subject: [rsyslog] rsyslog freeze dude
>>
>> Hello
>> If I configure rsyslog client like this:
>>
>> WorkDirectory /root/rsyslog
>> $ActionQueueType LinkedList
>> $ActionQueueFileName myfile
>> $ActionResumeRetryCount -1
>>
>> and
>>
>> *.* @@somehost.domain.com
>>
>> Is possible that lost of conectivity (internet down) of this server
>> during days, produce that server freeze? or not be possible to login
>>
> to
>
>> the machine?
>>
>> If I do /etc/init.d/rsyslog restart it takes long long time to
>>
> restart.
>
>> Please Rainer I hope you help me. thanks
>>
>>
>> --
>> Mikel Jimenez Fernandez
>> Irontec, Internet y Sistemas sobre GNU/LinuX - http://www.irontec.com
>> +34 94.404.81.82
>>
>>
>> _______________________________________________
>> rsyslog mailing list
>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com
>>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com
>
Hello Rainer


root@ironpbx:~# rsyslogd -v
rsyslogd 3.16.1, compiled with:
FEATURE_REGEXP: Yes
FEATURE_LARGEFILE: Yes
FEATURE_NETZIP (message compression): Yes
GSSAPI Kerberos 5 support: No
FEATURE_DEBUG (debug build, slow code): No
Runtime Instrumentation (slow code): No

See http://www.rsyslog.com for more information.



Say me if you need more information.

--
Mikel Jimenez Fernandez
Irontec, Internet y Sistemas sobre GNU/LinuX - http://www.irontec.com
+34 94.404.81.82


_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com

Hi Mikel,

> -----Original Message-----
> From: rsyslog-bounces@lists.adiscon.com [mailto:rsyslog-
> bounces@lists.adiscon.com] On Behalf Of Mikel Jimenez
> Sent: Wednesday, November 26, 2008 4:55 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] rsyslog freeze dude

> root@ironpbx:~# rsyslogd -v
> rsyslogd 3.16.1, compiled with:
> FEATURE_REGEXP: Yes
> FEATURE_LARGEFILE: Yes
> FEATURE_NETZIP (message compression): Yes
> GSSAPI Kerberos 5 support: No
> FEATURE_DEBUG (debug build, slow code): No
> Runtime Instrumentation (slow code): No
>
> See http://www.rsyslog.com for more information.

Please upgrade to the recent v3-stable. That will probably solve the big
issue, if not all.

Rainer
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com

Rainer Gerhards escribió:
> Hi Mikel,
>
>
>> -----Original Message-----
>> From: rsyslog-bounces@lists.adiscon.com [mailto:rsyslog-
>> bounces@lists.adiscon.com] On Behalf Of Mikel Jimenez
>> Sent: Wednesday, November 26, 2008 4:55 PM
>> To: rsyslog-users
>> Subject: Re: [rsyslog] rsyslog freeze dude
>>
>
>
>> root@ironpbx:~# rsyslogd -v
>> rsyslogd 3.16.1, compiled with:
>> FEATURE_REGEXP: Yes
>> FEATURE_LARGEFILE: Yes
>> FEATURE_NETZIP (message compression): Yes
>> GSSAPI Kerberos 5 support: No
>> FEATURE_DEBUG (debug build, slow code): No
>> Runtime Instrumentation (slow code): No
>>
>> See http://www.rsyslog.com for more information.
>>
>
> Please upgrade to the recent v3-stable. That will probably solve the big
> issue, if not all.
>
> Rainer
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com
>
OK

What is the last stable version?

There is a debian package?
Other thing:
The workDirectory is necesary that exist?
For example: WorkDirectory /rsyslog/work is a directory in / called
rsyslog and another one inside this called work?

If they aren´t can cause a bug?

--
Mikel Jimenez Fernandez
Irontec, Internet y Sistemas sobre GNU/LinuX - http://www.irontec.com
+34 94.404.81.82


_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com

> OK
>
> What is the last stable version?

I checked, it is 3.20.0 (and while checking I noticed that the project status was once again outdated ;))

>
> There is a debian package?

This I don't know.

> Other thing:
> The workDirectory is necesary that exist?
Yes, absolutely

> For example: WorkDirectory /rsyslog/work is a directory in / called
> rsyslog and another one inside this called work?
>
> If they aren´t can cause a bug?

I'd say yes.

Rainer
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com

Rainer Gerhards escribió:
>> OK
>>
>> What is the last stable version?
>>
>
> I checked, it is 3.20.0 (and while checking I noticed that the project status was once again outdated ;))
>
>
>> There is a debian package?
>>
>
> This I don't know.
>
>
>> Other thing:
>> The workDirectory is necesary that exist?
>>
> Yes, absolutely
>
>
>> For example: WorkDirectory /rsyslog/work is a directory in / called
>> rsyslog and another one inside this called work?
>>
>> If they aren´t can cause a bug?
>>
>
> I'd say yes.
>
> Rainer
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com
>

Before installing this version, would be possible to do more debugging?

--
Mikel Jimenez Fernandez
Irontec, Internet y Sistemas sobre GNU/LinuX - http://www.irontec.com
+34 94.404.81.82


_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com

> Before installing this version, would be possible to do more
debugging?

Sorry, I don't want to upset you, but I have no time to look at things
already fixed. Quite seriously, we have paid support options for this. I
see that it can make sense for you to stay with the older version, but
there is absolutely no benefit to the community. Sorry...

Rainer
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com

Rainer Gerhards escribió:
>> Before installing this version, would be possible to do more
>>
> debugging?
>
> Sorry, I don't want to upset you, but I have no time to look at things
> already fixed. Quite seriously, we have paid support options for this. I
> see that it can make sense for you to stay with the older version, but
> there is absolutely no benefit to the community. Sorry...
>
> Rainer
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com
>
Ok Rainer
Thanks, really. I´m going to use the stable version.

Last question:
Why could be the reason, if I block internet in this host, and when pass
10-12 hours, obviously not logging to remote (because firewall), but why
not locally to?

I do:
logger "message"

And I have not notice in /var/log/syslog or /var/log/messages, and in
normal situations yes...

Thanks

--
Mikel Jimenez Fernandez
Irontec, Internet y Sistemas sobre GNU/LinuX - http://www.irontec.com
+34 94.404.81.82


_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com

Mikel,

sorry, I was busy yesterday. See inline...
On Thu, 2008-11-27 at 10:07 +0100, Mikel Jimenez wrote:

> Last question:
> Why could be the reason, if I block internet in this host, and when pass
> 10-12 hours, obviously not logging to remote (because firewall), but why
> not locally to?
>
> I do:
> logger "message"
>
> And I have not notice in /var/log/syslog or /var/log/messages, and in
> normal situations yes...

If I am right (the update will prove that) the reason is that the local
log socket is not read (because rsyslog delays imuxsock) and thus fills
up. Then, other processes trying to write to that socket will block
during the write process.

Please note that the rsyslog core will discard messages after some time,
but the rate at which this happens is too slow to get the system back to
normal. As I said, this should disappear with the recent stable version.

HTH
Rainer

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com

Rainer Gerhards escribió:
> Mikel,
>
> sorry, I was busy yesterday. See inline...
> On Thu, 2008-11-27 at 10:07 +0100, Mikel Jimenez wrote:
>
>
>> Last question:
>> Why could be the reason, if I block internet in this host, and when pass
>> 10-12 hours, obviously not logging to remote (because firewall), but why
>> not locally to?
>>
>> I do:
>> logger "message"
>>
>> And I have not notice in /var/log/syslog or /var/log/messages, and in
>> normal situations yes...
>>
>
> If I am right (the update will prove that) the reason is that the local
> log socket is not read (because rsyslog delays imuxsock) and thus fills
> up. Then, other processes trying to write to that socket will block
> during the write process.
>
> Please note that the rsyslog core will discard messages after some time,
> but the rate at which this happens is too slow to get the system back to
> normal. As I said, this should disappear with the recent stable version.
>
> HTH
> Rainer
>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com
>
Thanks for your explication Rainer!! I will install 3.20 right now!!

--
Mikel Jimenez Fernandez
Irontec, Internet y Sistemas sobre GNU/LinuX - http://www.irontec.com
+34 94.404.81.82


_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com

> Thanks for your explication Rainer!! I will install 3.20 right now!!

Please let me know if the problem then re-appears. I don't think so, but
if it does this is definitely something we should look into ASAP. I'd
also appreciate if you let me know if the issue is fixed after the
upgrade.

Rainer
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com

Rainer Gerhards escribió:
>> Thanks for your explication Rainer!! I will install 3.20 right now!!
>>
>
> Please let me know if the problem then re-appears. I don't think so, but
> if it does this is definitely something we should look into ASAP. I'd
> also appreciate if you let me know if the issue is fixed after the
> upgrade.
>
> Rainer
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com
>
Ok, I will do it

--
Mikel Jimenez Fernandez
Irontec, Internet y Sistemas sobre GNU/LinuX - http://www.irontec.com
+34 94.404.81.82


_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com