[rsyslog-notify] Forum Thread: Re: ompipe(action failed) or omfile( queues are filling) - (Mode 'edit_last_post')

[noreply at adiscon.com]

User: printul77700 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=26553#p26553

Message: 
----------
Hi!
Thanks for the input;

[quote="dlang":kyh9q4kv]

it's not a good idea to have queues feed queues with no real actions. so
don't put a queue on both the ruleset and the only action in the ruleset.
(the process moving things between queues can't operate reasonably and the
queues end up locked far too much of the time)


[quote="printul77700":kyh9q4kv]So let's say I could take the queues out in
front of the actions and leave only the ruleset queue-you say it is
faster.So I can increase the ruleset queue to cover my needs.
But if I have multiple actions in the ruleset then I think I need to keep
it, true? [/quote:kyh9q4kv]





rsyslog -N2 does a syntax check of the config file and one layer of
includes (N3 does two layers of includes, etc)


omfile writing to a file seldom has problems keeping up unless your
filesystem is slow (say, NFS) or if a pipe is involved and you aren't
reading the pipe fast enough. There are things you can do to configure
linux to allocate larger buffers to the pipes.

[quote="printul77700":kyh9q4kv]Regarding the pipes, I guess I need to make
readers to read pipes faster or just send the events to multiple pipes so
this way the messages will be spread over more pipes/actions.
I guess is the only way to solve it, because I lose events messages even
with queues of 100000  events/messages in front of the queues..so a bigger
buffer I guess would not help to much, I guess, not sure.
Also not sure what is the footprint regarding going so uyp with the
queues-they might impact the system afterwall, as they write to memory(
lynkedlist) [/quote:kyh9q4kv]

[/quote:kyh9q4kv]

[quote="printul77700":kyh9q4kv]Also another problem I have is understanding
exactly the thread/batch things.I read something about one thread and small
batches may have issues as the rsyslog will use that thread to process the
incoming message while not being able to eventually send it to action, but
not sure I got it right.Maybe this thread/batch thing might help a
little?[/quote:kyh9q4kv]

Thanks a lot