Mailing List Archive

Running rsyslog 8.2001 on Debian 10 we do monitor file changes with use of
iWatch [1].
Within monitoring we occasionally see a lot of messages
Aug 26 00:01:10 loco iWatch[3575]: *
/chroot/net/var/spool/rsyslog/mainq.qi.tmp is moved to
/chroot/net/var/spool/rsyslog/mainq.qi
Aug 26 00:01:10 loco iWatch[3575]: *
/chroot/net/var/spool/rsyslog/mainq.qi.tmp is moved to
/chroot/net/var/spool/rsyslog/mainq.qi
and sometimes
Aug 26 00:01:10 loco iWatch[3575]: *
/chroot/net/var/spool/rsyslog/mainq.qi.tmp is closed
or other messages regarding the closing and deleting the message queue
files.

There are 1564 messages logged within one second causing the filesystem
being full. Where 1427 are related to main.qi.tmp being moved to main.qi
file.

Seems the queue index file is always open in "sync" mode and the
queue.checkpointinterval [2] and queue.syncqueuefiles [3] are used for the
message queue files only.
Is that assumption correct? Is there any way to modify the queue index file
handling?

Thank you.

[1] http://iwatch.sourceforge.net/index.html
[2]
https://www.rsyslog.com/doc/master/rainerscript/queue_parameters.html#queue-checkpointinterval
[3]
https://www.rsyslog.com/doc/master/rainerscript/queue_parameters.html#queue-syncqueuefiles

--
Peter
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.