KnowledgeBase Event Repository

This site is the central interface to the Adiscon Event Repository

  • Details for this entry
  • Accessed: 615

Discuss the Event

Discussion for KB Entry 7213 - Syslogtag rsyslogd-2358

by knowledgebase on Tue Dec 03, 2013 9:32 am

This is the discussion thread for the Knowledge Base Entry 7213

Vendor: Adiscon
Software/Device: rsyslog
Syslogtag: rsyslogd-2358
Link to KB Entry

Short Description:
Warning queue full delay mark below high wtr mark
Forum Bot
Posts: 170
Joined: Wed May 28, 2008 10:09 am

Re: Discussion for KB Entry 7213 - Syslogtag rsyslogd-2358

by rgerhards on Mon Oct 23, 2017 1:16 pm

This message occurs if a queue is configured to use a disk queue if it runs out of space, but the queue.fullDelayMark configuration has been set lower than the high water mark (which initiates shutdown). For delayable (imtcp, imptcp, imfile, ...) sources, this means the DA queue will never start.

This usually indicates an error condition, but might be desired if the same queue is used by delayable and non-delayble inputs sources, like TCP and UDP input. In the latter case, it would actually prevent delayable sources from using the disk queue, but keep it as option if sufficient data from non-delayable sources (UDP) arrive. This use case, however, is relatively seldom. If it is desired, a better solution might be to have two different queues( e.g. via rulesets) for delayable and non-delayable sources. This solution is also recommended for clarity.

A user should careful evaluate if the configuration is actually performing as desired.
Site Admin
Posts: 3807
Joined: Thu Feb 13, 2003 11:57 am

About the KnowledgeBase Event Repository

This is a repository of known Windows Events, hopefully together with a description of what it means, when it appears and how to troubleshoot it. The event repository was initially provided as a tool for parser creation but has since evolved. It is now part of the overall knowledgebase in the hope that it provides a useful service to the community. Please add your comments and questions (which we try to answer), as this increases the event repository usefulness for all of us.

Return to