Mailing List Archive

1 2  View All
Re: [E]Re: Missing messages [ In reply to ]
David,

I see how to modify it, instead of an action block, but I don't see how it can be applied in the context of my rsyslog.conf, which doesn't have any action blocks.
I'm using: https://www.rsyslog.com/doc/v8-stable/configuration/modules/omfile.html#dynaFileCacheSize as my reference.

I'm guessing the section of my config file I need to modify is:
### DEAL WITH REMOTE MESSAGES ########################################
$DirGroup secopsr
$FileGroup secopsr
$umask 0000
$DirCreateMode 0754
$FileCreateMode 0644
$template RemoteClient,"/var/remote/logs/%HOSTNAME%/%HOSTNAME%-%$NOW%.log"
:inputname , isequal , "imudp" ?RemoteClient
:inputname , isequal , "imtcp" ?RemoteClient
:fromhost-ip , !isequal , "127.0.0.1" stop
########################################################################

Just not seeing how to modify it the right way to set the dynaFileCacheSize value.

Radesh

-----Original Message-----
From: David Lang <david@lang.hm>
Sent: Friday, August 02, 2019 8:06 PM
To: Singh, Radesh <Radesh_Singh@csx.com>
Cc: David Lang <david@lang.hm>; Singh, Radesh via rsyslog <rsyslog@lists.adiscon.com>
Subject: RE: [E]Re: [rsyslog] Missing messages

fix the dynafilecachesize, that is probably why you are loosing your inbound logs.

this should help keep you from loosing your outbound logs

David Lang

On Fri, 2 Aug 2019, Singh, Radesh wrote:

> Date: Fri, 2 Aug 2019 23:59:21 +0000
> From: "Singh, Radesh" <Radesh_Singh@csx.com>
> To: David Lang <david@lang.hm>
> Cc: "Singh, Radesh via rsyslog" <rsyslog@lists.adiscon.com>
> Subject: RE: [E]Re: [rsyslog] Missing messages
>
> :) I went big...
> sysctl net.core.wmem_max
> net.core.wmem_max = 134217728
>
> then cycled rsyslog.
>
>
> -----Original Message-----
> From: David Lang <david@lang.hm>
> Sent: Friday, August 02, 2019 7:54 PM
> To: Singh, Radesh <Radesh_Singh@csx.com>
> Cc: David Lang <david@lang.hm>; Singh, Radesh via rsyslog
> <rsyslog@lists.adiscon.com>
> Subject: RE: [E]Re: [rsyslog] Missing messages
>
> On Fri, 2 Aug 2019, Singh, Radesh wrote:
>
>> Outbound buffers, would that be net.core.wmem_max?
>
> yes, and I think it's in bytes, set is something nice and large,
> several tens of MB
>
> from a random web page, for 25MB 26214400
>
> David Lang
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: [E]Re: Missing messages [ In reply to ]
you would have to use the obsolete $DynaFileCacheSize before each output

bit it really is better to switch to the new action() syntax, using the old way
results is side effects that you don't expect

on the current version, you can use the -o flag to get rsyslog to dump what it's
parsed it's config into, which would help a lot with the conversion, but that
wasn't available on 8.24

try putting the line:
$DynaFileCacheSize 1000
before each of the ?RemoteClient lines

David Lang

On Sat, 3 Aug 2019, Singh, Radesh wrote:

> Date: Sat, 3 Aug 2019 00:21:40 +0000
> From: "Singh, Radesh" <Radesh_Singh@csx.com>
> To: David Lang <david@lang.hm>
> Cc: "Singh, Radesh via rsyslog" <rsyslog@lists.adiscon.com>
> Subject: RE: [E]Re: [rsyslog] Missing messages
>
> David,
>
> I see how to modify it, instead of an action block, but I don't see how it can be applied in the context of my rsyslog.conf, which doesn't have any action blocks.
> I'm using: https://www.rsyslog.com/doc/v8-stable/configuration/modules/omfile.html#dynaFileCacheSize as my reference.
>
> I'm guessing the section of my config file I need to modify is:
> ### DEAL WITH REMOTE MESSAGES ########################################
> $DirGroup secopsr
> $FileGroup secopsr
> $umask 0000
> $DirCreateMode 0754
> $FileCreateMode 0644
> $template RemoteClient,"/var/remote/logs/%HOSTNAME%/%HOSTNAME%-%$NOW%.log"
> :inputname , isequal , "imudp" ?RemoteClient
> :inputname , isequal , "imtcp" ?RemoteClient
> :fromhost-ip , !isequal , "127.0.0.1" stop
> ########################################################################
>
> Just not seeing how to modify it the right way to set the dynaFileCacheSize value.
>
> Radesh
>
> -----Original Message-----
> From: David Lang <david@lang.hm>
> Sent: Friday, August 02, 2019 8:06 PM
> To: Singh, Radesh <Radesh_Singh@csx.com>
> Cc: David Lang <david@lang.hm>; Singh, Radesh via rsyslog <rsyslog@lists.adiscon.com>
> Subject: RE: [E]Re: [rsyslog] Missing messages
>
> fix the dynafilecachesize, that is probably why you are loosing your inbound logs.
>
> this should help keep you from loosing your outbound logs
>
> David Lang
>
> On Fri, 2 Aug 2019, Singh, Radesh wrote:
>
>> Date: Fri, 2 Aug 2019 23:59:21 +0000
>> From: "Singh, Radesh" <Radesh_Singh@csx.com>
>> To: David Lang <david@lang.hm>
>> Cc: "Singh, Radesh via rsyslog" <rsyslog@lists.adiscon.com>
>> Subject: RE: [E]Re: [rsyslog] Missing messages
>>
>> :) I went big...
>> sysctl net.core.wmem_max
>> net.core.wmem_max = 134217728
>>
>> then cycled rsyslog.
>>
>>
>> -----Original Message-----
>> From: David Lang <david@lang.hm>
>> Sent: Friday, August 02, 2019 7:54 PM
>> To: Singh, Radesh <Radesh_Singh@csx.com>
>> Cc: David Lang <david@lang.hm>; Singh, Radesh via rsyslog
>> <rsyslog@lists.adiscon.com>
>> Subject: RE: [E]Re: [rsyslog] Missing messages
>>
>> On Fri, 2 Aug 2019, Singh, Radesh wrote:
>>
>>> Outbound buffers, would that be net.core.wmem_max?
>>
>> yes, and I think it's in bytes, set is something nice and large,
>> several tens of MB
>>
>> from a random web page, for 25MB 26214400
>>
>> David Lang
>>
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: [E]Re: Missing messages [ In reply to ]
So many options on the newer code.
If we can get over this hurdle seriously push to get onto a newer code base.

In any event, I've added:

### DEAL WITH REMOTE MESSAGES ########################################
$DirGroup secopsr
$FileGroup secopsr
$umask 0000
$DirCreateMode 0754
$FileCreateMode 0644
$DynaFileCacheSize 1000
$template RemoteClient,"/var/remote/logs/%HOSTNAME%/%HOSTNAME%-%$NOW%.log"
:inputname , isequal , "imudp" ?RemoteClient
:inputname , isequal , "imtcp" ?RemoteClient
:fromhost-ip , !isequal , "127.0.0.1" stop
########################################################################

Cycled the daemon, watching error counters.



-----Original Message-----
From: David Lang <david@lang.hm>
Sent: Friday, August 02, 2019 8:26 PM
To: Singh, Radesh <Radesh_Singh@csx.com>
Cc: David Lang <david@lang.hm>; Singh, Radesh via rsyslog <rsyslog@lists.adiscon.com>
Subject: RE: [E]Re: [rsyslog] Missing messages

you would have to use the obsolete $DynaFileCacheSize before each output

bit it really is better to switch to the new action() syntax, using the old way results is side effects that you don't expect

on the current version, you can use the -o flag to get rsyslog to dump what it's parsed it's config into, which would help a lot with the conversion, but that wasn't available on 8.24

try putting the line:
$DynaFileCacheSize 1000
before each of the ?RemoteClient lines

David Lang

On Sat, 3 Aug 2019, Singh, Radesh wrote:

> Date: Sat, 3 Aug 2019 00:21:40 +0000
> From: "Singh, Radesh" <Radesh_Singh@csx.com>
> To: David Lang <david@lang.hm>
> Cc: "Singh, Radesh via rsyslog" <rsyslog@lists.adiscon.com>
> Subject: RE: [E]Re: [rsyslog] Missing messages
>
> David,
>
> I see how to modify it, instead of an action block, but I don't see how it can be applied in the context of my rsyslog.conf, which doesn't have any action blocks.
> I'm using: https://secure-web.cisco.com/1m4qbe7BlK4JGfHkUJkk2pPjlBsRPNrgrZ6_xiWUWaGlSm8E3-0u4_B6chh8K2zRtg20Y2YKKIUlkF1Xib6ckcSJQt8O00AeGRNIDUZBUEnxUBI_OV8HxNHIdedbCtE8b6GU30lZUvpY5HW-Al0WtIzjaEWR_BikSWOHsHrZKqThtJVPH48bhwVnbbaHV-janxV1KR0UDAQjllhSNCuujkX2wsDvcPhGC_SUJJFdxuHGnwWfz6zSU_FXc1TLB2k8A8ajVrYZlNeO385xLoCgcCsg0R1vFbZWYI6UgbsWOmM-6WDUuO94HkwdEMpPjNUtSXEyA1WCb8crzCoFmY3jnVmA9LhjpUwn97BV8TdB9dy8R6R0fKDpJZlQq1_1V0VxP/https%3A%2F%2Fwww.rsyslog.com%2Fdoc%2Fv8-stable%2Fconfiguration%2Fmodules%2Fomfile.html#dynaFileCacheSize as my reference.
>
> I'm guessing the section of my config file I need to modify is:
> ### DEAL WITH REMOTE MESSAGES
> ########################################
> $DirGroup secopsr
> $FileGroup secopsr
> $umask 0000
> $DirCreateMode 0754
> $FileCreateMode 0644
> $template RemoteClient,"/var/remote/logs/%HOSTNAME%/%HOSTNAME%-%$NOW%.log"
> :inputname , isequal , "imudp" ?RemoteClient :inputname , isequal ,
> "imtcp" ?RemoteClient :fromhost-ip , !isequal , "127.0.0.1" stop
> ######################################################################
> ##
>
> Just not seeing how to modify it the right way to set the dynaFileCacheSize value.
>
> Radesh
>
> -----Original Message-----
> From: David Lang <david@lang.hm>
> Sent: Friday, August 02, 2019 8:06 PM
> To: Singh, Radesh <Radesh_Singh@csx.com>
> Cc: David Lang <david@lang.hm>; Singh, Radesh via rsyslog
> <rsyslog@lists.adiscon.com>
> Subject: RE: [E]Re: [rsyslog] Missing messages
>
> fix the dynafilecachesize, that is probably why you are loosing your inbound logs.
>
> this should help keep you from loosing your outbound logs
>
> David Lang
>
> On Fri, 2 Aug 2019, Singh, Radesh wrote:
>
>> Date: Fri, 2 Aug 2019 23:59:21 +0000
>> From: "Singh, Radesh" <Radesh_Singh@csx.com>
>> To: David Lang <david@lang.hm>
>> Cc: "Singh, Radesh via rsyslog" <rsyslog@lists.adiscon.com>
>> Subject: RE: [E]Re: [rsyslog] Missing messages
>>
>> :) I went big...
>> sysctl net.core.wmem_max
>> net.core.wmem_max = 134217728
>>
>> then cycled rsyslog.
>>
>>
>> -----Original Message-----
>> From: David Lang <david@lang.hm>
>> Sent: Friday, August 02, 2019 7:54 PM
>> To: Singh, Radesh <Radesh_Singh@csx.com>
>> Cc: David Lang <david@lang.hm>; Singh, Radesh via rsyslog
>> <rsyslog@lists.adiscon.com>
>> Subject: RE: [E]Re: [rsyslog] Missing messages
>>
>> On Fri, 2 Aug 2019, Singh, Radesh wrote:
>>
>>> Outbound buffers, would that be net.core.wmem_max?
>>
>> yes, and I think it's in bytes, set is something nice and large,
>> several tens of MB
>>
>> from a random web page, for 25MB 26214400
>>
>> David Lang
>>
>

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: [E]Re: Missing messages [ In reply to ]
Whoa! Error counters are no longer incrementing!

-----Original Message-----
From: rsyslog <rsyslog-bounces@lists.adiscon.com> On Behalf Of Singh, Radesh via rsyslog
Sent: Friday, August 02, 2019 8:35 PM
To: David Lang <david@lang.hm>
Cc: Singh, Radesh <Radesh_Singh@csx.com>; Singh, Radesh via rsyslog <rsyslog@lists.adiscon.com>
Subject: Re: [rsyslog] [E]Re: Missing messages

So many options on the newer code.
If we can get over this hurdle seriously push to get onto a newer code base.

In any event, I've added:

### DEAL WITH REMOTE MESSAGES ########################################
$DirGroup secopsr
$FileGroup secopsr
$umask 0000
$DirCreateMode 0754
$FileCreateMode 0644
$DynaFileCacheSize 1000
$template RemoteClient,"/var/remote/logs/%HOSTNAME%/%HOSTNAME%-%$NOW%.log"
:inputname , isequal , "imudp" ?RemoteClient :inputname , isequal , "imtcp" ?RemoteClient :fromhost-ip , !isequal , "127.0.0.1" stop ########################################################################

Cycled the daemon, watching error counters.



-----Original Message-----
From: David Lang <david@lang.hm>
Sent: Friday, August 02, 2019 8:26 PM
To: Singh, Radesh <Radesh_Singh@csx.com>
Cc: David Lang <david@lang.hm>; Singh, Radesh via rsyslog <rsyslog@lists.adiscon.com>
Subject: RE: [E]Re: [rsyslog] Missing messages

you would have to use the obsolete $DynaFileCacheSize before each output

bit it really is better to switch to the new action() syntax, using the old way results is side effects that you don't expect

on the current version, you can use the -o flag to get rsyslog to dump what it's parsed it's config into, which would help a lot with the conversion, but that wasn't available on 8.24

try putting the line:
$DynaFileCacheSize 1000
before each of the ?RemoteClient lines

David Lang

On Sat, 3 Aug 2019, Singh, Radesh wrote:

> Date: Sat, 3 Aug 2019 00:21:40 +0000
> From: "Singh, Radesh" <Radesh_Singh@csx.com>
> To: David Lang <david@lang.hm>
> Cc: "Singh, Radesh via rsyslog" <rsyslog@lists.adiscon.com>
> Subject: RE: [E]Re: [rsyslog] Missing messages
>
> David,
>
> I see how to modify it, instead of an action block, but I don't see how it can be applied in the context of my rsyslog.conf, which doesn't have any action blocks.
> I'm using: https://secure-web.cisco.com/1m4qbe7BlK4JGfHkUJkk2pPjlBsRPNrgrZ6_xiWUWaGlSm8E3-0u4_B6chh8K2zRtg20Y2YKKIUlkF1Xib6ckcSJQt8O00AeGRNIDUZBUEnxUBI_OV8HxNHIdedbCtE8b6GU30lZUvpY5HW-Al0WtIzjaEWR_BikSWOHsHrZKqThtJVPH48bhwVnbbaHV-janxV1KR0UDAQjllhSNCuujkX2wsDvcPhGC_SUJJFdxuHGnwWfz6zSU_FXc1TLB2k8A8ajVrYZlNeO385xLoCgcCsg0R1vFbZWYI6UgbsWOmM-6WDUuO94HkwdEMpPjNUtSXEyA1WCb8crzCoFmY3jnVmA9LhjpUwn97BV8TdB9dy8R6R0fKDpJZlQq1_1V0VxP/https%3A%2F%2Fwww.rsyslog.com%2Fdoc%2Fv8-stable%2Fconfiguration%2Fmodules%2Fomfile.html#dynaFileCacheSize as my reference.
>
> I'm guessing the section of my config file I need to modify is:
> ### DEAL WITH REMOTE MESSAGES
> ########################################
> $DirGroup secopsr
> $FileGroup secopsr
> $umask 0000
> $DirCreateMode 0754
> $FileCreateMode 0644
> $template RemoteClient,"/var/remote/logs/%HOSTNAME%/%HOSTNAME%-%$NOW%.log"
> :inputname , isequal , "imudp" ?RemoteClient :inputname , isequal ,
> "imtcp" ?RemoteClient :fromhost-ip , !isequal , "127.0.0.1" stop
> ######################################################################
> ##
>
> Just not seeing how to modify it the right way to set the dynaFileCacheSize value.
>
> Radesh
>
> -----Original Message-----
> From: David Lang <david@lang.hm>
> Sent: Friday, August 02, 2019 8:06 PM
> To: Singh, Radesh <Radesh_Singh@csx.com>
> Cc: David Lang <david@lang.hm>; Singh, Radesh via rsyslog
> <rsyslog@lists.adiscon.com>
> Subject: RE: [E]Re: [rsyslog] Missing messages
>
> fix the dynafilecachesize, that is probably why you are loosing your inbound logs.
>
> this should help keep you from loosing your outbound logs
>
> David Lang
>
> On Fri, 2 Aug 2019, Singh, Radesh wrote:
>
>> Date: Fri, 2 Aug 2019 23:59:21 +0000
>> From: "Singh, Radesh" <Radesh_Singh@csx.com>
>> To: David Lang <david@lang.hm>
>> Cc: "Singh, Radesh via rsyslog" <rsyslog@lists.adiscon.com>
>> Subject: RE: [E]Re: [rsyslog] Missing messages
>>
>> :) I went big...
>> sysctl net.core.wmem_max
>> net.core.wmem_max = 134217728
>>
>> then cycled rsyslog.
>>
>>
>> -----Original Message-----
>> From: David Lang <david@lang.hm>
>> Sent: Friday, August 02, 2019 7:54 PM
>> To: Singh, Radesh <Radesh_Singh@csx.com>
>> Cc: David Lang <david@lang.hm>; Singh, Radesh via rsyslog
>> <rsyslog@lists.adiscon.com>
>> Subject: RE: [E]Re: [rsyslog] Missing messages
>>
>> On Fri, 2 Aug 2019, Singh, Radesh wrote:
>>
>>> Outbound buffers, would that be net.core.wmem_max?
>>
>> yes, and I think it's in bytes, set is something nice and large,
>> several tens of MB
>>
>> from a random web page, for 25MB 26214400
>>
>> David Lang
>>
>

_______________________________________________
rsyslog mailing list
http://secure-web.cisco.com/1gPNkKTvjqDyt8n7_9pVsYNn-QWAvSGc8mNom-Hpx8LuJlKl7v39ZGEgKayFVcWEEhcGOVVvYzXHMI1njB5J0XBQMAQ5X72DZdoo4zB-teQ9O_wVpQlPFQQvzZwpCR2bGFZ-is_0XAqAAAvU4y2ENWs7fdEUajdv4bZE8PKqO1s4znNZLSh9TFcgSjFJ9gpS_5B2ngqPL_gdmKWS81gh8KLZ6IJe3TRDpGZM2kYYFDrd2RDmEHXFwVHWlaULsfkS3uhfpDPmiEZmStgyrIXaPr0kX4Sx2UTdroytdD6TVEwRWG1z6DpP6_hFyU0D2_JvCfHy-7qHNSdwQQL1cJ766o735pJCEWwFv2jmVCx2P5bMjhnXXeLs3y-5sJnzI1iqn/http%3A%2F%2Flists.adiscon.net%2Fmailman%2Flistinfo%2Frsyslog
http://secure-web.cisco.com/1j5UMHWeYp153Uqio3Bs2Z4sNXUZKqcugLojNNOQ9cYnOvhGfkjclSIg-lR2klG_DRUt6Ov2aLcvAxz_pfhsGX_2y2LKe143IY57nFdN1gCVPYYNoZoOGhx26LZE30IFprhbXY2mAUEn0O4mUFVV_8jYleHPgeX137zBoZs4ZrKaSyrGn5uUE158rwKP3HyK9orzlt2Yq9fhuXYmBM0DjKU-3BUAU88upmnIZnTjmECfzeUbhtoyN4E5e70WhphKQadh7X0LmJW9kIONsyH-w6ox6bA_MkilEHMxiVl_BzcPrSLhFB_iF4VcVOQ2IV40Up86rczAIn2hs5pA6AAnTS7IFH561VrQ8zdRct-d9optqSg9_44IT9Mz0Vo2CTRqHtIgNT5KTBe5wDiDkdgD-FA/http%3A%2F%2Fwww.rsyslog.com%2Fprofessional-services%2F
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: [E]Re: Missing messages [ In reply to ]
put it before EACH of the lines (this is one of those side effects that I'm
mentioning, I think DynaFileCacheSize only affect the _next_ action

also, this won't change the error messages you posted, but this should make a
huge difference to the input performance and the stats

give me a couple cycles of the stats output

David Lang
On Sat, 3 Aug 2019, Singh, Radesh wrote:

> Date: Sat, 3 Aug 2019 00:35:23 +0000
> From: "Singh, Radesh" <Radesh_Singh@csx.com>
> To: David Lang <david@lang.hm>
> Cc: "Singh, Radesh via rsyslog" <rsyslog@lists.adiscon.com>
> Subject: RE: [E]Re: [rsyslog] Missing messages
>
> So many options on the newer code.
> If we can get over this hurdle seriously push to get onto a newer code base.
>
> In any event, I've added:
>
> ### DEAL WITH REMOTE MESSAGES ########################################
> $DirGroup secopsr
> $FileGroup secopsr
> $umask 0000
> $DirCreateMode 0754
> $FileCreateMode 0644
> $DynaFileCacheSize 1000
> $template RemoteClient,"/var/remote/logs/%HOSTNAME%/%HOSTNAME%-%$NOW%.log"
> :inputname , isequal , "imudp" ?RemoteClient
> :inputname , isequal , "imtcp" ?RemoteClient
> :fromhost-ip , !isequal , "127.0.0.1" stop
> ########################################################################
>
> Cycled the daemon, watching error counters.
>
>
>
> -----Original Message-----
> From: David Lang <david@lang.hm>
> Sent: Friday, August 02, 2019 8:26 PM
> To: Singh, Radesh <Radesh_Singh@csx.com>
> Cc: David Lang <david@lang.hm>; Singh, Radesh via rsyslog <rsyslog@lists.adiscon.com>
> Subject: RE: [E]Re: [rsyslog] Missing messages
>
> you would have to use the obsolete $DynaFileCacheSize before each output
>
> bit it really is better to switch to the new action() syntax, using the old way results is side effects that you don't expect
>
> on the current version, you can use the -o flag to get rsyslog to dump what it's parsed it's config into, which would help a lot with the conversion, but that wasn't available on 8.24
>
> try putting the line:
> $DynaFileCacheSize 1000
> before each of the ?RemoteClient lines
>
> David Lang
>
> On Sat, 3 Aug 2019, Singh, Radesh wrote:
>
>> Date: Sat, 3 Aug 2019 00:21:40 +0000
>> From: "Singh, Radesh" <Radesh_Singh@csx.com>
>> To: David Lang <david@lang.hm>
>> Cc: "Singh, Radesh via rsyslog" <rsyslog@lists.adiscon.com>
>> Subject: RE: [E]Re: [rsyslog] Missing messages
>>
>> David,
>>
>> I see how to modify it, instead of an action block, but I don't see how it can be applied in the context of my rsyslog.conf, which doesn't have any action blocks.
>> I'm using: https://secure-web.cisco.com/1m4qbe7BlK4JGfHkUJkk2pPjlBsRPNrgrZ6_xiWUWaGlSm8E3-0u4_B6chh8K2zRtg20Y2YKKIUlkF1Xib6ckcSJQt8O00AeGRNIDUZBUEnxUBI_OV8HxNHIdedbCtE8b6GU30lZUvpY5HW-Al0WtIzjaEWR_BikSWOHsHrZKqThtJVPH48bhwVnbbaHV-janxV1KR0UDAQjllhSNCuujkX2wsDvcPhGC_SUJJFdxuHGnwWfz6zSU_FXc1TLB2k8A8ajVrYZlNeO385xLoCgcCsg0R1vFbZWYI6UgbsWOmM-6WDUuO94HkwdEMpPjNUtSXEyA1WCb8crzCoFmY3jnVmA9LhjpUwn97BV8TdB9dy8R6R0fKDpJZlQq1_1V0VxP/https%3A%2F%2Fwww.rsyslog.com%2Fdoc%2Fv8-stable%2Fconfiguration%2Fmodules%2Fomfile.html#dynaFileCacheSize as my reference.
>>
>> I'm guessing the section of my config file I need to modify is:
>> ### DEAL WITH REMOTE MESSAGES
>> ########################################
>> $DirGroup secopsr
>> $FileGroup secopsr
>> $umask 0000
>> $DirCreateMode 0754
>> $FileCreateMode 0644
>> $template RemoteClient,"/var/remote/logs/%HOSTNAME%/%HOSTNAME%-%$NOW%.log"
>> :inputname , isequal , "imudp" ?RemoteClient :inputname , isequal ,
>> "imtcp" ?RemoteClient :fromhost-ip , !isequal , "127.0.0.1" stop
>> ######################################################################
>> ##
>>
>> Just not seeing how to modify it the right way to set the dynaFileCacheSize value.
>>
>> Radesh
>>
>> -----Original Message-----
>> From: David Lang <david@lang.hm>
>> Sent: Friday, August 02, 2019 8:06 PM
>> To: Singh, Radesh <Radesh_Singh@csx.com>
>> Cc: David Lang <david@lang.hm>; Singh, Radesh via rsyslog
>> <rsyslog@lists.adiscon.com>
>> Subject: RE: [E]Re: [rsyslog] Missing messages
>>
>> fix the dynafilecachesize, that is probably why you are loosing your inbound logs.
>>
>> this should help keep you from loosing your outbound logs
>>
>> David Lang
>>
>> On Fri, 2 Aug 2019, Singh, Radesh wrote:
>>
>>> Date: Fri, 2 Aug 2019 23:59:21 +0000
>>> From: "Singh, Radesh" <Radesh_Singh@csx.com>
>>> To: David Lang <david@lang.hm>
>>> Cc: "Singh, Radesh via rsyslog" <rsyslog@lists.adiscon.com>
>>> Subject: RE: [E]Re: [rsyslog] Missing messages
>>>
>>> :) I went big...
>>> sysctl net.core.wmem_max
>>> net.core.wmem_max = 134217728
>>>
>>> then cycled rsyslog.
>>>
>>>
>>> -----Original Message-----
>>> From: David Lang <david@lang.hm>
>>> Sent: Friday, August 02, 2019 7:54 PM
>>> To: Singh, Radesh <Radesh_Singh@csx.com>
>>> Cc: David Lang <david@lang.hm>; Singh, Radesh via rsyslog
>>> <rsyslog@lists.adiscon.com>
>>> Subject: RE: [E]Re: [rsyslog] Missing messages
>>>
>>> On Fri, 2 Aug 2019, Singh, Radesh wrote:
>>>
>>>> Outbound buffers, would that be net.core.wmem_max?
>>>
>>> yes, and I think it's in bytes, set is something nice and large,
>>> several tens of MB
>>>
>>> from a random web page, for 25MB 26214400
>>>
>>> David Lang
>>>
>>
>
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: [E]Re: Missing messages [ In reply to ]
At first, I figured you meant:

$DirGroup secopsr
$FileGroup secopsr
$umask 0000
$DirCreateMode 0754
$FileCreateMode 0644
$template RemoteClient,"/var/remote/logs/%HOSTNAME%/%HOSTNAME%-%$NOW%.log"
$DynaFileCacheSize 1000 :inputname , isequal , "imudp" ?RemoteClient
$DynaFileCacheSize 1000 :inputname , isequal , "imtcp" ?RemoteClient
:fromhost-ip , !isequal , "127.0.0.1" stop

But this resulted in a syntax error:
rsyslogd -N 1
rsyslogd: version 8.24.0, config validation run (level 1), master config /etc/rsyslog.conf
rsyslogd: error: extra characters in config line ignored: ':inputname , isequal , "imudp" ?RemoteClient' [v8.24.0]
rsyslogd: error: extra characters in config line ignored: ':inputname , isequal , "imtcp" ?RemoteClient' [v8.24.0]

So, I looked around and found this: http://www.l3jane.net/doc/rsyslog/configuration/action/rsconf1_dynafilecachesize.html and assumed I'd misunderstood what you posted.

Radesh

-----Original Message-----
From: David Lang <david@lang.hm>
Sent: Friday, August 02, 2019 8:40 PM
To: Singh, Radesh <Radesh_Singh@csx.com>
Cc: David Lang <david@lang.hm>; Singh, Radesh via rsyslog <rsyslog@lists.adiscon.com>
Subject: RE: [E]Re: [rsyslog] Missing messages

put it before EACH of the lines (this is one of those side effects that I'm mentioning, I think DynaFileCacheSize only affect the _next_ action

also, this won't change the error messages you posted, but this should make a huge difference to the input performance and the stats

give me a couple cycles of the stats output

David Lang
On Sat, 3 Aug 2019, Singh, Radesh wrote:

> Date: Sat, 3 Aug 2019 00:35:23 +0000
> From: "Singh, Radesh" <Radesh_Singh@csx.com>
> To: David Lang <david@lang.hm>
> Cc: "Singh, Radesh via rsyslog" <rsyslog@lists.adiscon.com>
> Subject: RE: [E]Re: [rsyslog] Missing messages
>
> So many options on the newer code.
> If we can get over this hurdle seriously push to get onto a newer code base.
>
> In any event, I've added:
>
> ### DEAL WITH REMOTE MESSAGES
> ########################################
> $DirGroup secopsr
> $FileGroup secopsr
> $umask 0000
> $DirCreateMode 0754
> $FileCreateMode 0644
> $DynaFileCacheSize 1000
> $template RemoteClient,"/var/remote/logs/%HOSTNAME%/%HOSTNAME%-%$NOW%.log"
> :inputname , isequal , "imudp" ?RemoteClient :inputname , isequal ,
> "imtcp" ?RemoteClient :fromhost-ip , !isequal , "127.0.0.1" stop
> ######################################################################
> ##
>
> Cycled the daemon, watching error counters.
>
>
>
> -----Original Message-----
> From: David Lang <david@lang.hm>
> Sent: Friday, August 02, 2019 8:26 PM
> To: Singh, Radesh <Radesh_Singh@csx.com>
> Cc: David Lang <david@lang.hm>; Singh, Radesh via rsyslog
> <rsyslog@lists.adiscon.com>
> Subject: RE: [E]Re: [rsyslog] Missing messages
>
> you would have to use the obsolete $DynaFileCacheSize before each
> output
>
> bit it really is better to switch to the new action() syntax, using
> the old way results is side effects that you don't expect
>
> on the current version, you can use the -o flag to get rsyslog to dump
> what it's parsed it's config into, which would help a lot with the
> conversion, but that wasn't available on 8.24
>
> try putting the line:
> $DynaFileCacheSize 1000
> before each of the ?RemoteClient lines
>
> David Lang
>
> On Sat, 3 Aug 2019, Singh, Radesh wrote:
>
>> Date: Sat, 3 Aug 2019 00:21:40 +0000
>> From: "Singh, Radesh" <Radesh_Singh@csx.com>
>> To: David Lang <david@lang.hm>
>> Cc: "Singh, Radesh via rsyslog" <rsyslog@lists.adiscon.com>
>> Subject: RE: [E]Re: [rsyslog] Missing messages
>>
>> David,
>>
>> I see how to modify it, instead of an action block, but I don't see how it can be applied in the context of my rsyslog.conf, which doesn't have any action blocks.
>> I'm using: https://secure-web.cisco.com/1m4qbe7BlK4JGfHkUJkk2pPjlBsRPNrgrZ6_xiWUWaGlSm8E3-0u4_B6chh8K2zRtg20Y2YKKIUlkF1Xib6ckcSJQt8O00AeGRNIDUZBUEnxUBI_OV8HxNHIdedbCtE8b6GU30lZUvpY5HW-Al0WtIzjaEWR_BikSWOHsHrZKqThtJVPH48bhwVnbbaHV-janxV1KR0UDAQjllhSNCuujkX2wsDvcPhGC_SUJJFdxuHGnwWfz6zSU_FXc1TLB2k8A8ajVrYZlNeO385xLoCgcCsg0R1vFbZWYI6UgbsWOmM-6WDUuO94HkwdEMpPjNUtSXEyA1WCb8crzCoFmY3jnVmA9LhjpUwn97BV8TdB9dy8R6R0fKDpJZlQq1_1V0VxP/https%3A%2F%2Fwww.rsyslog.com%2Fdoc%2Fv8-stable%2Fconfiguration%2Fmodules%2Fomfile.html#dynaFileCacheSize as my reference.
>>
>> I'm guessing the section of my config file I need to modify is:
>> ### DEAL WITH REMOTE MESSAGES
>> ########################################
>> $DirGroup secopsr
>> $FileGroup secopsr
>> $umask 0000
>> $DirCreateMode 0754
>> $FileCreateMode 0644
>> $template RemoteClient,"/var/remote/logs/%HOSTNAME%/%HOSTNAME%-%$NOW%.log"
>> :inputname , isequal , "imudp" ?RemoteClient :inputname , isequal ,
>> "imtcp" ?RemoteClient :fromhost-ip , !isequal , "127.0.0.1" stop
>> #####################################################################
>> #
>> ##
>>
>> Just not seeing how to modify it the right way to set the dynaFileCacheSize value.
>>
>> Radesh
>>
>> -----Original Message-----
>> From: David Lang <david@lang.hm>
>> Sent: Friday, August 02, 2019 8:06 PM
>> To: Singh, Radesh <Radesh_Singh@csx.com>
>> Cc: David Lang <david@lang.hm>; Singh, Radesh via rsyslog
>> <rsyslog@lists.adiscon.com>
>> Subject: RE: [E]Re: [rsyslog] Missing messages
>>
>> fix the dynafilecachesize, that is probably why you are loosing your inbound logs.
>>
>> this should help keep you from loosing your outbound logs
>>
>> David Lang
>>
>> On Fri, 2 Aug 2019, Singh, Radesh wrote:
>>
>>> Date: Fri, 2 Aug 2019 23:59:21 +0000
>>> From: "Singh, Radesh" <Radesh_Singh@csx.com>
>>> To: David Lang <david@lang.hm>
>>> Cc: "Singh, Radesh via rsyslog" <rsyslog@lists.adiscon.com>
>>> Subject: RE: [E]Re: [rsyslog] Missing messages
>>>
>>> :) I went big...
>>> sysctl net.core.wmem_max
>>> net.core.wmem_max = 134217728
>>>
>>> then cycled rsyslog.
>>>
>>>
>>> -----Original Message-----
>>> From: David Lang <david@lang.hm>
>>> Sent: Friday, August 02, 2019 7:54 PM
>>> To: Singh, Radesh <Radesh_Singh@csx.com>
>>> Cc: David Lang <david@lang.hm>; Singh, Radesh via rsyslog
>>> <rsyslog@lists.adiscon.com>
>>> Subject: RE: [E]Re: [rsyslog] Missing messages
>>>
>>> On Fri, 2 Aug 2019, Singh, Radesh wrote:
>>>
>>>> Outbound buffers, would that be net.core.wmem_max?
>>>
>>> yes, and I think it's in bytes, set is something nice and large,
>>> several tens of MB
>>>
>>> from a random web page, for 25MB 26214400
>>>
>>> David Lang
>>>
>>
>
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: [E]Re: Missing messages [ In reply to ]
$DirGroup secopsr
$FileGroup secopsr
$umask 0000
$DirCreateMode 0754
$FileCreateMode 0644
$template RemoteClient,"/var/remote/logs/%HOSTNAME%/%HOSTNAME%-%$NOW%.log"
$DynaFileCacheSize 1000
:inputname , isequal , "imudp" ?RemoteClient
$DynaFileCacheSize 1000
:inputname , isequal , "imtcp" ?RemoteClient
:fromhost-ip , !isequal , "127.0.0.1" stop

you lucked out tht the udp output was first, and since you aren't getting
anything via TCP, the question of if it is set there or not doesn't matter.

what does the stats output show?

David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: [E]Re: Missing messages [ In reply to ]
2019-08-02T20:39:11.898986-04:00 lnx21648 rsyslogd-pstats: global: origin=dynstats
2019-08-02T20:39:11.898991-04:00 lnx21648 rsyslogd-pstats: imuxsock: origin=imuxsock submitted=0 ratelimit.discarded=0 ratelimit.numratelimiters=0
2019-08-02T20:39:11.898993-04:00 lnx21648 rsyslogd-pstats: action 0: origin=core.action processed=0 failed=0 suspended=0 suspended.duration=0 resumed=0
2019-08-02T20:39:11.898994-04:00 lnx21648 rsyslogd-pstats: action 1: origin=core.action processed=3866463 failed=0 suspended=0 suspended.duration=0 resumed=0
2019-08-02T20:39:11.898995-04:00 lnx21648 rsyslogd-pstats: action 2: origin=core.action processed=3866463 failed=0 suspended=0 suspended.duration=0 resumed=0
2019-08-02T20:39:11.898997-04:00 lnx21648 rsyslogd-pstats: dynafile cache RemoteClient: origin=omfile requests=5811219 level0=3191120 missed=56 evicted=0 maxused=56 closetimeouts=0
2019-08-02T20:39:11.899000-04:00 lnx21648 rsyslogd-pstats: action 3: origin=core.action processed=5811344 failed=0 suspended=0 suspended.duration=0 resumed=0
2019-08-02T20:39:11.899007-04:00 lnx21648 rsyslogd-pstats: dynafile cache RemoteClient: origin=omfile requests=0 level0=0 missed=0 evicted=0 maxused=0 closetimeouts=0
2019-08-02T20:39:11.899008-04:00 lnx21648 rsyslogd-pstats: action 4: origin=core.action processed=0 failed=0 suspended=0 suspended.duration=0 resumed=0
2019-08-02T20:39:11.899010-04:00 lnx21648 rsyslogd-pstats: action 5: origin=core.action processed=9 failed=0 suspended=0 suspended.duration=0 resumed=0
2019-08-02T20:39:11.899010-04:00 lnx21648 rsyslogd-pstats: action 6: origin=core.action processed=2 failed=0 suspended=0 suspended.duration=0 resumed=0
2019-08-02T20:39:11.899012-04:00 lnx21648 rsyslogd-pstats: action 7: origin=core.action processed=0 failed=0 suspended=0 suspended.duration=0 resumed=0
2019-08-02T20:39:11.899014-04:00 lnx21648 rsyslogd-pstats: action 8: origin=core.action processed=0 failed=0 suspended=0 suspended.duration=0 resumed=0
2019-08-02T20:39:11.899015-04:00 lnx21648 rsyslogd-pstats: action 9: origin=core.action processed=0 failed=0 suspended=0 suspended.duration=0 resumed=0
2019-08-02T20:39:11.899016-04:00 lnx21648 rsyslogd-pstats: action 10: origin=core.action processed=0 failed=0 suspended=0 suspended.duration=0 resumed=0
2019-08-02T20:39:11.899017-04:00 lnx21648 rsyslogd-pstats: action 11: origin=core.action processed=0 failed=0 suspended=0 suspended.duration=0 resumed=0
2019-08-02T20:39:11.899018-04:00 lnx21648 rsyslogd-pstats: action 12: origin=core.action processed=0 failed=0 suspended=0 suspended.duration=0 resumed=0
2019-08-02T20:39:11.899019-04:00 lnx21648 rsyslogd-pstats: action 13: origin=core.action processed=9 failed=0 suspended=0 suspended.duration=0 resumed=0
2019-08-02T20:39:11.899022-04:00 lnx21648 rsyslogd-pstats: action 14: origin=core.action processed=2 failed=0 suspended=0 suspended.duration=0 resumed=0
2019-08-02T20:39:11.899023-04:00 lnx21648 rsyslogd-pstats: action 15: origin=core.action processed=0 failed=0 suspended=0 suspended.duration=0 resumed=0
2019-08-02T20:39:11.899024-04:00 lnx21648 rsyslogd-pstats: action 16: origin=core.action processed=0 failed=0 suspended=0 suspended.duration=0 resumed=0
2019-08-02T20:39:11.899026-04:00 lnx21648 rsyslogd-pstats: resource-usage: origin=impstats utime=44426249 stime=61434223 maxrss=11848 minflt=82853 majflt=0 inblock=0 oublock=2184784 nvcsw=4479353 nivcsw=8404
2019-08-02T20:39:11.899028-04:00 lnx21648 rsyslogd-pstats: RSYSLOG_DefaultRuleset: origin=core.queue size=0 enqueued=0 full=0 discarded.full=0 discarded.nf=0 maxqsize=0
2019-08-02T20:39:11.899030-04:00 lnx21648 rsyslogd-pstats: main Q: origin=core.queue size=171 enqueued=5811386 full=0 discarded.full=0 discarded.nf=0 maxqsize=3412
2019-08-02T20:39:11.899032-04:00 lnx21648 rsyslogd-pstats: imudp(w0): origin=imudp called.recvmmsg=7799005 called.recvmsg=0 msgs.received=5811352

-----Original Message-----
From: David Lang <david@lang.hm>
Sent: Friday, August 02, 2019 8:47 PM
To: Singh, Radesh <Radesh_Singh@csx.com>
Cc: David Lang <david@lang.hm>; Singh, Radesh via rsyslog <rsyslog@lists.adiscon.com>
Subject: RE: [E]Re: [rsyslog] Missing messages

$DirGroup secopsr
$FileGroup secopsr
$umask 0000
$DirCreateMode 0754
$FileCreateMode 0644
$template RemoteClient,"/var/remote/logs/%HOSTNAME%/%HOSTNAME%-%$NOW%.log"
$DynaFileCacheSize 1000
:inputname , isequal , "imudp" ?RemoteClient $DynaFileCacheSize 1000 :inputname , isequal , "imtcp" ?RemoteClient :fromhost-ip , !isequal , "127.0.0.1" stop

you lucked out tht the udp output was first, and since you aren't getting anything via TCP, the question of if it is set there or not doesn't matter.

what does the stats output show?

David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: [E]Re: Missing messages [ In reply to ]
On Sat, 3 Aug 2019, Singh, Radesh wrote:

> 2019-08-02T20:39:11.898986-04:00 lnx21648 rsyslogd-pstats: global: origin=dynstats
> 2019-08-02T20:39:11.898991-04:00 lnx21648 rsyslogd-pstats: imuxsock: origin=imuxsock submitted=0 ratelimit.discarded=0 ratelimit.numratelimiters=0
> 2019-08-02T20:39:11.898993-04:00 lnx21648 rsyslogd-pstats: action 0: origin=core.action processed=0 failed=0 suspended=0 suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.898994-04:00 lnx21648 rsyslogd-pstats: action 1: origin=core.action processed=3866463 failed=0 suspended=0 suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.898995-04:00 lnx21648 rsyslogd-pstats: action 2: origin=core.action processed=3866463 failed=0 suspended=0 suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.898997-04:00 lnx21648 rsyslogd-pstats: dynafile cache RemoteClient: origin=omfile requests=5811219 level0=3191120 missed=56 evicted=0 maxused=56 closetimeouts=0

ok, this shows that you only needed 56, not 1000, but this takes very little
memory, so leave it good and high (to understand this, try setting it to 55 or
50 and see how it's going to be almost as bad as when you had it set to 10)

> 2019-08-02T20:39:11.899000-04:00 lnx21648 rsyslogd-pstats: action 3: origin=core.action processed=5811344 failed=0 suspended=0 suspended.duration=0 resumed=0

I think this is your remote send, it looks like the increase in the wmem has
kept that from being the bottleneck (and 128M is not a significant amount of
memory on your system)

Linux was developed on a 386 with 4M of ram, it tends to have very stingy buffer
sizing (it's been enlarged over the years, but it's still stingy), so it's a
good idea to check these sorts of things when you are dedicating a box to a
single purpose and driving it hard. These generally won't matter if you are
using it as a general desktop.

> 2019-08-02T20:39:11.899007-04:00 lnx21648 rsyslogd-pstats: dynafile cache RemoteClient: origin=omfile requests=0 level0=0 missed=0 evicted=0 maxused=0 closetimeouts=0
> 2019-08-02T20:39:11.899008-04:00 lnx21648 rsyslogd-pstats: action 4: origin=core.action processed=0 failed=0 suspended=0 suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899010-04:00 lnx21648 rsyslogd-pstats: action 5: origin=core.action processed=9 failed=0 suspended=0 suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899010-04:00 lnx21648 rsyslogd-pstats: action 6: origin=core.action processed=2 failed=0 suspended=0 suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899012-04:00 lnx21648 rsyslogd-pstats: action 7: origin=core.action processed=0 failed=0 suspended=0 suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899014-04:00 lnx21648 rsyslogd-pstats: action 8: origin=core.action processed=0 failed=0 suspended=0 suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899015-04:00 lnx21648 rsyslogd-pstats: action 9: origin=core.action processed=0 failed=0 suspended=0 suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899016-04:00 lnx21648 rsyslogd-pstats: action 10: origin=core.action processed=0 failed=0 suspended=0 suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899017-04:00 lnx21648 rsyslogd-pstats: action 11: origin=core.action processed=0 failed=0 suspended=0 suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899018-04:00 lnx21648 rsyslogd-pstats: action 12: origin=core.action processed=0 failed=0 suspended=0 suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899019-04:00 lnx21648 rsyslogd-pstats: action 13: origin=core.action processed=9 failed=0 suspended=0 suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899022-04:00 lnx21648 rsyslogd-pstats: action 14: origin=core.action processed=2 failed=0 suspended=0 suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899023-04:00 lnx21648 rsyslogd-pstats: action 15: origin=core.action processed=0 failed=0 suspended=0 suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899024-04:00 lnx21648 rsyslogd-pstats: action 16: origin=core.action processed=0 failed=0 suspended=0 suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899026-04:00 lnx21648 rsyslogd-pstats: resource-usage: origin=impstats utime=44426249 stime=61434223 maxrss=11848 minflt=82853 majflt=0 inblock=0 oublock=2184784 nvcsw=4479353 nivcsw=8404
> 2019-08-02T20:39:11.899028-04:00 lnx21648 rsyslogd-pstats: RSYSLOG_DefaultRuleset: origin=core.queue size=0 enqueued=0 full=0 discarded.full=0 discarded.nf=0 maxqsize=0
> 2019-08-02T20:39:11.899030-04:00 lnx21648 rsyslogd-pstats: main Q: origin=core.queue size=171 enqueued=5811386 full=0 discarded.full=0 discarded.nf=0 maxqsize=3412
> 2019-08-02T20:39:11.899032-04:00 lnx21648 rsyslogd-pstats: imudp(w0): origin=imudp called.recvmmsg=7799005 called.recvmsg=0 msgs.received=5811352
>
> -----Original Message-----
> From: David Lang <david@lang.hm>
> Sent: Friday, August 02, 2019 8:47 PM
> To: Singh, Radesh <Radesh_Singh@csx.com>
> Cc: David Lang <david@lang.hm>; Singh, Radesh via rsyslog <rsyslog@lists.adiscon.com>
> Subject: RE: [E]Re: [rsyslog] Missing messages
>
> $DirGroup secopsr
> $FileGroup secopsr
> $umask 0000
> $DirCreateMode 0754
> $FileCreateMode 0644
> $template RemoteClient,"/var/remote/logs/%HOSTNAME%/%HOSTNAME%-%$NOW%.log"
> $DynaFileCacheSize 1000
> :inputname , isequal , "imudp" ?RemoteClient $DynaFileCacheSize 1000 :inputname , isequal , "imtcp" ?RemoteClient :fromhost-ip , !isequal , "127.0.0.1" stop
>
> you lucked out tht the udp output was first, and since you aren't getting anything via TCP, the question of if it is set there or not doesn't matter.
>
> what does the stats output show?
>
> David Lang
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: [E]Re: Missing messages [ In reply to ]
Do you think other tuning would be advisable at this point?
I'm gonna get my firewall guy to check and see if he's still missing messages.

Radesh

-----Original Message-----
From: David Lang <david@lang.hm>
Sent: Friday, August 02, 2019 9:00 PM
To: Singh, Radesh <Radesh_Singh@csx.com>
Cc: David Lang <david@lang.hm>; Singh, Radesh via rsyslog <rsyslog@lists.adiscon.com>
Subject: RE: [E]Re: [rsyslog] Missing messages

On Sat, 3 Aug 2019, Singh, Radesh wrote:

> 2019-08-02T20:39:11.898986-04:00 lnx21648 rsyslogd-pstats: global:
> origin=dynstats
> 2019-08-02T20:39:11.898991-04:00 lnx21648 rsyslogd-pstats: imuxsock:
> origin=imuxsock submitted=0 ratelimit.discarded=0
> ratelimit.numratelimiters=0
> 2019-08-02T20:39:11.898993-04:00 lnx21648 rsyslogd-pstats: action 0:
> origin=core.action processed=0 failed=0 suspended=0
> suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.898994-04:00 lnx21648 rsyslogd-pstats: action 1:
> origin=core.action processed=3866463 failed=0 suspended=0
> suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.898995-04:00 lnx21648 rsyslogd-pstats: action 2:
> origin=core.action processed=3866463 failed=0 suspended=0
> suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.898997-04:00 lnx21648 rsyslogd-pstats: dynafile
> cache RemoteClient: origin=omfile requests=5811219 level0=3191120
> missed=56 evicted=0 maxused=56 closetimeouts=0

ok, this shows that you only needed 56, not 1000, but this takes very little memory, so leave it good and high (to understand this, try setting it to 55 or
50 and see how it's going to be almost as bad as when you had it set to 10)

> 2019-08-02T20:39:11.899000-04:00 lnx21648 rsyslogd-pstats: action 3:
> origin=core.action processed=5811344 failed=0 suspended=0
> suspended.duration=0 resumed=0

I think this is your remote send, it looks like the increase in the wmem has kept that from being the bottleneck (and 128M is not a significant amount of memory on your system)

Linux was developed on a 386 with 4M of ram, it tends to have very stingy buffer sizing (it's been enlarged over the years, but it's still stingy), so it's a good idea to check these sorts of things when you are dedicating a box to a single purpose and driving it hard. These generally won't matter if you are using it as a general desktop.

> 2019-08-02T20:39:11.899007-04:00 lnx21648 rsyslogd-pstats: dynafile
> cache RemoteClient: origin=omfile requests=0 level0=0 missed=0
> evicted=0 maxused=0 closetimeouts=0
> 2019-08-02T20:39:11.899008-04:00 lnx21648 rsyslogd-pstats: action 4:
> origin=core.action processed=0 failed=0 suspended=0
> suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899010-04:00 lnx21648 rsyslogd-pstats: action 5:
> origin=core.action processed=9 failed=0 suspended=0
> suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899010-04:00 lnx21648 rsyslogd-pstats: action 6:
> origin=core.action processed=2 failed=0 suspended=0
> suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899012-04:00 lnx21648 rsyslogd-pstats: action 7:
> origin=core.action processed=0 failed=0 suspended=0
> suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899014-04:00 lnx21648 rsyslogd-pstats: action 8:
> origin=core.action processed=0 failed=0 suspended=0
> suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899015-04:00 lnx21648 rsyslogd-pstats: action 9:
> origin=core.action processed=0 failed=0 suspended=0
> suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899016-04:00 lnx21648 rsyslogd-pstats: action 10:
> origin=core.action processed=0 failed=0 suspended=0
> suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899017-04:00 lnx21648 rsyslogd-pstats: action 11:
> origin=core.action processed=0 failed=0 suspended=0
> suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899018-04:00 lnx21648 rsyslogd-pstats: action 12:
> origin=core.action processed=0 failed=0 suspended=0
> suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899019-04:00 lnx21648 rsyslogd-pstats: action 13:
> origin=core.action processed=9 failed=0 suspended=0
> suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899022-04:00 lnx21648 rsyslogd-pstats: action 14:
> origin=core.action processed=2 failed=0 suspended=0
> suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899023-04:00 lnx21648 rsyslogd-pstats: action 15:
> origin=core.action processed=0 failed=0 suspended=0
> suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899024-04:00 lnx21648 rsyslogd-pstats: action 16:
> origin=core.action processed=0 failed=0 suspended=0
> suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899026-04:00 lnx21648 rsyslogd-pstats:
> resource-usage: origin=impstats utime=44426249 stime=61434223
> maxrss=11848 minflt=82853 majflt=0 inblock=0 oublock=2184784
> nvcsw=4479353 nivcsw=8404
> 2019-08-02T20:39:11.899028-04:00 lnx21648 rsyslogd-pstats:
> RSYSLOG_DefaultRuleset: origin=core.queue size=0 enqueued=0 full=0
> discarded.full=0 discarded.nf=0 maxqsize=0
> 2019-08-02T20:39:11.899030-04:00 lnx21648 rsyslogd-pstats: main Q:
> origin=core.queue size=171 enqueued=5811386 full=0 discarded.full=0
> discarded.nf=0 maxqsize=3412
> 2019-08-02T20:39:11.899032-04:00 lnx21648 rsyslogd-pstats: imudp(w0):
> origin=imudp called.recvmmsg=7799005 called.recvmsg=0
> msgs.received=5811352
>
> -----Original Message-----
> From: David Lang <david@lang.hm>
> Sent: Friday, August 02, 2019 8:47 PM
> To: Singh, Radesh <Radesh_Singh@csx.com>
> Cc: David Lang <david@lang.hm>; Singh, Radesh via rsyslog
> <rsyslog@lists.adiscon.com>
> Subject: RE: [E]Re: [rsyslog] Missing messages
>
> $DirGroup secopsr
> $FileGroup secopsr
> $umask 0000
> $DirCreateMode 0754
> $FileCreateMode 0644
> $template RemoteClient,"/var/remote/logs/%HOSTNAME%/%HOSTNAME%-%$NOW%.log"
> $DynaFileCacheSize 1000
> :inputname , isequal , "imudp" ?RemoteClient $DynaFileCacheSize 1000
> :inputname , isequal , "imtcp" ?RemoteClient :fromhost-ip , !isequal ,
> "127.0.0.1" stop
>
> you lucked out tht the udp output was first, and since you aren't getting anything via TCP, the question of if it is set there or not doesn't matter.
>
> what does the stats output show?
>
> David Lang
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: [E]Re: Missing messages [ In reply to ]
if you are no longer getting any more errors on your os UDP stats, then I think
it's worth checking with your firewall guy and then start looking at upgrading
and converting your config

David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: [E]Re: Missing messages [ In reply to ]
Things look so much better.
I don't see the receive buffer errors incrementing and my receive queue is empty.



-----Original Message-----
From: rsyslog <rsyslog-bounces@lists.adiscon.com> On Behalf Of Singh, Radesh via rsyslog
Sent: Friday, August 02, 2019 9:03 PM
To: David Lang <david@lang.hm>
Cc: Singh, Radesh <Radesh_Singh@csx.com>; Singh, Radesh via rsyslog <rsyslog@lists.adiscon.com>
Subject: Re: [rsyslog] [E]Re: Missing messages

Do you think other tuning would be advisable at this point?
I'm gonna get my firewall guy to check and see if he's still missing messages.

Radesh

-----Original Message-----
From: David Lang <david@lang.hm>
Sent: Friday, August 02, 2019 9:00 PM
To: Singh, Radesh <Radesh_Singh@csx.com>
Cc: David Lang <david@lang.hm>; Singh, Radesh via rsyslog <rsyslog@lists.adiscon.com>
Subject: RE: [E]Re: [rsyslog] Missing messages

On Sat, 3 Aug 2019, Singh, Radesh wrote:

> 2019-08-02T20:39:11.898986-04:00 lnx21648 rsyslogd-pstats: global:
> origin=dynstats
> 2019-08-02T20:39:11.898991-04:00 lnx21648 rsyslogd-pstats: imuxsock:
> origin=imuxsock submitted=0 ratelimit.discarded=0
> ratelimit.numratelimiters=0
> 2019-08-02T20:39:11.898993-04:00 lnx21648 rsyslogd-pstats: action 0:
> origin=core.action processed=0 failed=0 suspended=0
> suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.898994-04:00 lnx21648 rsyslogd-pstats: action 1:
> origin=core.action processed=3866463 failed=0 suspended=0
> suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.898995-04:00 lnx21648 rsyslogd-pstats: action 2:
> origin=core.action processed=3866463 failed=0 suspended=0
> suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.898997-04:00 lnx21648 rsyslogd-pstats: dynafile
> cache RemoteClient: origin=omfile requests=5811219 level0=3191120
> missed=56 evicted=0 maxused=56 closetimeouts=0

ok, this shows that you only needed 56, not 1000, but this takes very little memory, so leave it good and high (to understand this, try setting it to 55 or
50 and see how it's going to be almost as bad as when you had it set to 10)

> 2019-08-02T20:39:11.899000-04:00 lnx21648 rsyslogd-pstats: action 3:
> origin=core.action processed=5811344 failed=0 suspended=0
> suspended.duration=0 resumed=0

I think this is your remote send, it looks like the increase in the wmem has kept that from being the bottleneck (and 128M is not a significant amount of memory on your system)

Linux was developed on a 386 with 4M of ram, it tends to have very stingy buffer sizing (it's been enlarged over the years, but it's still stingy), so it's a good idea to check these sorts of things when you are dedicating a box to a single purpose and driving it hard. These generally won't matter if you are using it as a general desktop.

> 2019-08-02T20:39:11.899007-04:00 lnx21648 rsyslogd-pstats: dynafile
> cache RemoteClient: origin=omfile requests=0 level0=0 missed=0
> evicted=0 maxused=0 closetimeouts=0
> 2019-08-02T20:39:11.899008-04:00 lnx21648 rsyslogd-pstats: action 4:
> origin=core.action processed=0 failed=0 suspended=0
> suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899010-04:00 lnx21648 rsyslogd-pstats: action 5:
> origin=core.action processed=9 failed=0 suspended=0
> suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899010-04:00 lnx21648 rsyslogd-pstats: action 6:
> origin=core.action processed=2 failed=0 suspended=0
> suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899012-04:00 lnx21648 rsyslogd-pstats: action 7:
> origin=core.action processed=0 failed=0 suspended=0
> suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899014-04:00 lnx21648 rsyslogd-pstats: action 8:
> origin=core.action processed=0 failed=0 suspended=0
> suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899015-04:00 lnx21648 rsyslogd-pstats: action 9:
> origin=core.action processed=0 failed=0 suspended=0
> suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899016-04:00 lnx21648 rsyslogd-pstats: action 10:
> origin=core.action processed=0 failed=0 suspended=0
> suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899017-04:00 lnx21648 rsyslogd-pstats: action 11:
> origin=core.action processed=0 failed=0 suspended=0
> suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899018-04:00 lnx21648 rsyslogd-pstats: action 12:
> origin=core.action processed=0 failed=0 suspended=0
> suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899019-04:00 lnx21648 rsyslogd-pstats: action 13:
> origin=core.action processed=9 failed=0 suspended=0
> suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899022-04:00 lnx21648 rsyslogd-pstats: action 14:
> origin=core.action processed=2 failed=0 suspended=0
> suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899023-04:00 lnx21648 rsyslogd-pstats: action 15:
> origin=core.action processed=0 failed=0 suspended=0
> suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899024-04:00 lnx21648 rsyslogd-pstats: action 16:
> origin=core.action processed=0 failed=0 suspended=0
> suspended.duration=0 resumed=0
> 2019-08-02T20:39:11.899026-04:00 lnx21648 rsyslogd-pstats:
> resource-usage: origin=impstats utime=44426249 stime=61434223
> maxrss=11848 minflt=82853 majflt=0 inblock=0 oublock=2184784
> nvcsw=4479353 nivcsw=8404
> 2019-08-02T20:39:11.899028-04:00 lnx21648 rsyslogd-pstats:
> RSYSLOG_DefaultRuleset: origin=core.queue size=0 enqueued=0 full=0
> discarded.full=0 discarded.nf=0 maxqsize=0
> 2019-08-02T20:39:11.899030-04:00 lnx21648 rsyslogd-pstats: main Q:
> origin=core.queue size=171 enqueued=5811386 full=0 discarded.full=0
> discarded.nf=0 maxqsize=3412
> 2019-08-02T20:39:11.899032-04:00 lnx21648 rsyslogd-pstats: imudp(w0):
> origin=imudp called.recvmmsg=7799005 called.recvmsg=0
> msgs.received=5811352
>
> -----Original Message-----
> From: David Lang <david@lang.hm>
> Sent: Friday, August 02, 2019 8:47 PM
> To: Singh, Radesh <Radesh_Singh@csx.com>
> Cc: David Lang <david@lang.hm>; Singh, Radesh via rsyslog
> <rsyslog@lists.adiscon.com>
> Subject: RE: [E]Re: [rsyslog] Missing messages
>
> $DirGroup secopsr
> $FileGroup secopsr
> $umask 0000
> $DirCreateMode 0754
> $FileCreateMode 0644
> $template RemoteClient,"/var/remote/logs/%HOSTNAME%/%HOSTNAME%-%$NOW%.log"
> $DynaFileCacheSize 1000
> :inputname , isequal , "imudp" ?RemoteClient $DynaFileCacheSize 1000
> :inputname , isequal , "imtcp" ?RemoteClient :fromhost-ip , !isequal ,
> "127.0.0.1" stop
>
> you lucked out tht the udp output was first, and since you aren't getting anything via TCP, the question of if it is set there or not doesn't matter.
>
> what does the stats output show?
>
> David Lang
>
_______________________________________________
rsyslog mailing list
http://secure-web.cisco.com/1IWqxqQiJktTL_0N8sPOpHFWX2PDh_Qvf3e24rTiXPtuzfty46wNRUz0y9BhESXtzRIHMZT4RRd1BT_s7s2Y7AMWyGBVkVoO0X95eGYrTnV3PPNoHdhTDI_cOilyILBL9_FSOY3vW9VIllbLr7CTU1oYHkG8MSb4P1E5ibEgk_bh6uVcWP7Y7b6wwn4gF-p-69RtsdSqQI63Rr84zmcPeTY1OMs1IYW4MKvwCrtwz7Jh_gIC6V44ycU8Iq_yDRivx_DCPG7qzpDydCTRJYdXymv7teNNER1DHdstw0ZECrquLOlZXqOnnXIKBOhdEV82lOYQImF7fLEUWEVFrrDvmx3uTfhiwAwliedKSJR0Zl_5Cz2HzYZTlzcW33Eq1bxbN/http%3A%2F%2Flists.adiscon.net%2Fmailman%2Flistinfo%2Frsyslog
http://secure-web.cisco.com/1E0tQdwoPB_HX_SH3qc4EShe_sKAZ29WLEZCgztv5H85TXdD331u_gsx49u21Pemk7FtNWqd_Kxc3DEDa2ZUT99XlimEeJkj_5USWljuJyiysfV2hV6odHnyDEGw4CVOozxG5eU7UBW2L0tOY_z1V9CuoKWYERwkr659gqGMYDB8h4UEk7m-8mhLETVl8mSv3fJvXn7cm-HO2PFElufuLB1fGaItklUCyRt-k8ibwLDDzQS73T1Tz6Ca3kjKI05fLc87ZSdm-uJAl8ZzthPxGKpa837thmgplOqi8SwKsz0KDIhmhoCKZV-kjscCBocu8lWiGhLs35JAcG6EFtIEzRaDX5OcRg0LnYH1ekYmQzOKve9OGn0JRjDuPeC9RAgeg36w-bnMBcT5FLIFwK1yG3Q/http%3A%2F%2Fwww.rsyslog.com%2Fprofessional-services%2F
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: [E]Re: Missing messages [ In reply to ]
Yessir, that's about the state of things... no errors in the UDP stats, and receive queue is getting emptied pretty quickly.
Thanks a bunch!

Radesh

-----Original Message-----
From: David Lang <david@lang.hm>
Sent: Friday, August 02, 2019 9:09 PM
To: Singh, Radesh <Radesh_Singh@csx.com>
Cc: David Lang <david@lang.hm>; Singh, Radesh via rsyslog <rsyslog@lists.adiscon.com>
Subject: RE: [E]Re: [rsyslog] Missing messages

if you are no longer getting any more errors on your os UDP stats, then I think it's worth checking with your firewall guy and then start looking at upgrading and converting your config

David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: [E]Re: Missing messages [ In reply to ]
what about transmit buffers?

David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: [E]Re: Missing messages [ In reply to ]
Send buffers?
If so, they've stayed pretty low this whole time.
The value is 290 right now, and has been 290 since earlier today.

-----Original Message-----
From: David Lang <david@lang.hm>
Sent: Friday, August 02, 2019 10:07 PM
To: Singh, Radesh <Radesh_Singh@csx.com>
Cc: rsyslog-users <rsyslog@lists.adiscon.com>; David Lang <david@lang.hm>
Subject: RE: [rsyslog] [E]Re: Missing messages

what about transmit buffers?

David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

1 2  View All