[rsyslog] omfwd stops working

[Rory Toma via rsyslog]

I'm having an issue with rsyslog 8.38.

It currently accepts tls connections, and then forwards them, plaintext,
to another syslog server.

It seems to work for about 90s. The connection gets closed down, goes
thru the fin_wait...close_wait cycle, and then gets re-established.
However, no data moves through anymore. In order to get it to work
again, I have to shut down rsyslog, wait for all the incoming sockets to
completely exit close_wait, then start up. Then it works for about 90s
again.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

[David Lang]

Post by Rory Toma via rsyslog
I'm having an issue with rsyslog 8.38.
It currently accepts tls connections, and then forwards them, plaintext, to
another syslog server.
It seems to work for about 90s. The connection gets closed down, goes thru
the fin_wait...close_wait cycle, and then gets re-established. However, no
data moves through anymore. In order to get it to work again, I have to shut
down rsyslog, wait for all the incoming sockets to completely exit
close_wait, then start up. Then it works for about 90s again.

we can't guess what your config is well enough to know what's happening.

But if I had to guess, I would guess that one of your destinations is not
accepting messages so a queue fills up and message processing stops

look at impstats and set it up to write info to a file every 20 sec or so and
see what it's reporting.

David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

[Rory Toma via rsyslog]

That's useful. I was unaware of impstats. Thx

Post by David Lang

Post by Rory Toma via rsyslog
I'm having an issue with rsyslog 8.38.
It currently accepts tls connections, and then forwards them,
plaintext, to another syslog server.
It seems to work for about 90s. The connection gets closed down, goes
thru the fin_wait...close_wait cycle, and then gets re-established.
However, no data moves through anymore. In order to get it to work
again, I have to shut down rsyslog, wait for all the incoming sockets
to completely exit close_wait, then start up. Then it works for about
90s again.

we can't guess what your config is well enough to know what's happening.
But if I had to guess, I would guess that one of your destinations is
not accepting messages so a queue fills up and message processing stops
look at impstats and set it up to write info to a file every 20 sec or
so and see what it's reporting.
David Lang