[rsyslog] Misconfiguration of ommail freezes system
david at lang.hm
Mon Jan 7 23:12:31 CET 2013
On Mon, 7 Jan 2013, Thomas Miedema wrote:
> specifying an empty smtp server and port for ommail freezes my system,
> supposedly when rsyslog tries to send the first email.
> $ActionMailSMTPServer <...>
> $ActionMailSMTPPort <...>
> Is this expected behaviour or a bug?
I am not surprised by it.
the syslog design is that applications writing messages to syslog stop doing all
work until the syslog daemon processes the message. If the syslog daemon cannot
process the message, this freezes the app writing the log. Since many such apps
are critical to the system running, this frequently results in the entire system
> In the following bug report ("rsyslog freezed if remote tcp port is
> blocked": http://bugzilla.adiscon.com/show_bug.cgi?id=285) Rainer mentions
> that "You need to use an async send queue to decouple the sender from the
> rest of the rules." I'm not sure this applies to ommail as well.
> The ommail documentation (http://www.rsyslog.com/doc/ommail.html) does not
> mention what will happen when no connection to the smtp server can be
Well, if a connection to the smtp server cannot be established, then rsyslog
cannot finish processing the message. This is effectivly the same as trying to
write a log message to a disk that's full, or sending a message via TCP or RELP
to a server that's not responding.
Rsyslog has a queue internally, but it will fill up and block. You can setup a
separate queue for a particular output, which will help, but eventually that
queue will fill up as well, and at that point the main queue will start filling.
You need to not only create a separate queue, you need to configure what you
want to happen when rsyslog is not able to deliver the message, and if you want
it to keep trying, what rsyslog should do when the queue starts filling up.
> I'm using rsyslog 5.8.6 on Ubuntu 12.04.
> Thank you for your help.
> Thomas Miedema
> rsyslog mailing list
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
More information about the rsyslog