[rsyslog] Internet drop followed by a restart - queue

[Alan Martinovic]

Hi,
am testing out a config file that should resend logs if there is a WiFi
drop followed by a restart.

The following steps show the issue:
[Starting state] rsyslog running. Internet connection stable
Killing the internet connection
logger "No internet connection. There wont be one before a system restart"
system restart
[Final state] rsyslog running. Internet connection stable

The logger message doesn't end up on the remote log server.
My conceptual idea was to set up a Disk-Assisted Memory Queue[1]
so the unset logger message survives restart by being written on the disk
and is resent once the network is back on.

I thought the following options:
```
...
action.resumeRetryCount="-1"
queue.type="LinkedList"
queue.filename="disk-queue"
queue.saveOnShutdown="on"
...
```

would make that happen, but it didn't.
Hunches on what could be wrong?

Be Well,
Alan

[1] https://www.rsyslog.com/doc/v8-stable/concepts/queues.html#disk-assisted-memory-queues

-----------------------------

Additional details:

```
cat /etc/rsyslog.conf

$ModLoad immark
$ModLoad imuxsock
$ModLoad imklog

$MaxMessageSize 64k
$WorkDirectory /var/spool/rsyslog

template(name="LogglyFormat"
type="string"
string="removing not to show token"
)

action(type="omfwd"
protocol="tcp" target="removed.log.url" port="514"
template="LogglyFormat"
action.resumeRetryCount="-1"
queue.type="LinkedList"
queue.filename="disk-queue"
queue.saveOnShutdown="on"
queue.size="5000"
queue.maxDiskSpace="20m"
)

ls -lad /var/spool/rsyslog/
drwxr-xr-x 2 root root 4096 Nov 14 17:43 /var/spool/rsyslog/
```
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

[David Lang]

One problem with TCP logging is that rsyslog has no visibility after it submits
the log to the OS, so what is happening here is that your "no connection"
message is going to rsyslog, it still thinks there is a connection open, so it
submits it to the OS and considers it sent.

also see
https://rainer.gerhards.net/2008/04/on-unreliability-of-plain-tcp-syslog.html

This is exactly the use case that RELP is designed for.

David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

[Scot Kreienkamp]

Post by David Lang
One problem with TCP logging is that rsyslog has no visibility after it submits
the log to the OS, so what is happening here is that your "no connection"
message is going to rsyslog, it still thinks there is a connection open, so it
submits it to the OS and considers it sent.
also see
https://rainer.gerhards.net/2008/04/on-unreliability-of-plain-tcp-syslog.html
This is exactly the use case that RELP is designed for.

I tried implementing RELP one time... it seems to be quite a bit more expensive on CPU time than standard TCP. I saw my CPU spike between 25-50% over plain TCP when I tried it on a high volume receiver. I would advise caution before implementing it on anything with high volume.

In my environment I don't need the guaranteed lossless so I've stuck with TCP. YMMV.

Scot Kreienkamp |Senior Systems Engineer | La-Z-Boy Corporate
One La-Z-Boy Drive| Monroe, Michigan 48162 | Office: 734-384-6403 | | Mobile: [phone] | Email: ***@la-z-boy.com

This message is intended only for the individual or entity to which it is addressed. It may contain privileged, confidential information which is exempt from disclosure under applicable laws. If you are not the intended recipient, you are strictly prohibited from disseminating or distributing this information (other than to the intended recipient) or copying this information. If you have received this communication in error, please notify us immediately by e-mail or by telephone at the above number. Thank you.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.