[rsyslog] Misconfiguration of ommail freezes system

David Lang david at lang.hm
Mon Jan 7 23:12:31 CET 2013


On Mon, 7 Jan 2013, Thomas Miedema wrote:

> Hello,
>
> specifying an empty smtp server and port for ommail freezes my system,
> supposedly when rsyslog tries to send the first email.
>
>  $ActionMailSMTPServer <...>
>  $ActionMailSMTPPort <...>
>
> Is this expected behaviour or a bug?

I am not surprised by it.

the syslog design is that applications writing messages to syslog stop doing all 
work until the syslog daemon processes the message. If the syslog daemon cannot 
process the message, this freezes the app writing the log. Since many such apps 
are critical to the system running, this frequently results in the entire system 
freezing.

> In the following bug report ("rsyslog freezed if remote tcp port is
> blocked": http://bugzilla.adiscon.com/show_bug.cgi?id=285) Rainer mentions
> that "You need to use an async send queue to decouple the sender from the
> rest of the rules." I'm not sure this applies to ommail as well.
>
> The ommail documentation (http://www.rsyslog.com/doc/ommail.html) does not
> mention what will happen when no connection to the smtp server can be
> established.

Well, if a connection to the smtp server cannot be established, then rsyslog 
cannot finish processing the message. This is effectivly the same as trying to 
write a log message to a disk that's full, or sending a message via TCP or RELP 
to a server that's not responding.

Rsyslog has a queue internally, but it will fill up and block. You can setup a 
separate queue for a particular output, which will help, but eventually that 
queue will fill up as well, and at that point the main queue will start filling.

You need to not only create a separate queue, you need to configure what you 
want to happen when rsyslog is not able to deliver the message, and if you want 
it to keep trying, what rsyslog should do when the queue starts filling up.

David Lang

> I'm using rsyslog 5.8.6 on Ubuntu 12.04.
>
> Thank you for your help.
>
> Regards,
> Thomas Miedema
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
>


More information about the rsyslog mailing list