Mailing List Archive

Rsyslog and TCP RESET
Hello everyone,

I have implemented configuration files linked list queues and everythings
works fine in my lab environment. However, when I put this configuration to
production I saw a behaviour that I do not know is related to my
configuration or not.

The TCP connections with the logsources keep restarting all the time and
only works at the beginning of a rsyslog restart.
This is my configuration:
if ($fromhost-ip == '1.2.3.4') then
{ action(type="omfwd"
queue.type="LinkedList"
queue.size="10000"
queue.filename="myqueue_queue"
queue.maxdiskspace="100000000"
action.resumeRetryCount="-1"
queue.saveonshutdown="on"
Target="10.10.1.10"
Port="514"
Protocol="tcp"
template="raw")
}

And the log source is ingesting around 4k EPS to the rsyslog server.
Could you please give me advice or knowledge about how to deal with it?

Kind regards,
Fran



--
Sent from: http://rsyslog-users.1305293.n2.nabble.com/
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: Rsyslog and TCP RESET [ In reply to ]
is there anything in front of rsyslog, like a load balancer? We just
use regular TCP socket calls, so there is actually nothing special...

Rainer

El jue., 12 nov. 2020 a las 9:47, Fva via rsyslog
(<rsyslog@lists.adiscon.com>) escribió:
>
> Hello everyone,
>
> I have implemented configuration files linked list queues and everythings
> works fine in my lab environment. However, when I put this configuration to
> production I saw a behaviour that I do not know is related to my
> configuration or not.
>
> The TCP connections with the logsources keep restarting all the time and
> only works at the beginning of a rsyslog restart.
> This is my configuration:
> if ($fromhost-ip == '1.2.3.4') then
> { action(type="omfwd"
> queue.type="LinkedList"
> queue.size="10000"
> queue.filename="myqueue_queue"
> queue.maxdiskspace="100000000"
> action.resumeRetryCount="-1"
> queue.saveonshutdown="on"
> Target="10.10.1.10"
> Port="514"
> Protocol="tcp"
> template="raw")
> }
>
> And the log source is ingesting around 4k EPS to the rsyslog server.
> Could you please give me advice or knowledge about how to deal with it?
>
> Kind regards,
> Fran
>
>
>
> --
> Sent from: http://rsyslog-users.1305293.n2.nabble.com/
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.