What happens if remote TCP port is not available

This is the place for you, if you got rsyslog up and running but wonder how to make it do what you want.

Moderator: rgerhards

Google Ads


What happens if remote TCP port is not available

Postby aje888 » Fri Aug 04, 2017 9:51 am

Hi.

We are forwarding some log events using:

local6.* @@server:port

There has been a concern raised of what happens if the server:port is not available / not open. I can't find anything in the documentation that states the rsyslog behaviour.

My assumption is the log events just get discarded?

Also, are there any statistics/volumetrics on what are 'acceptable' volumes that rsyslog will (easily) be able to handle? 1,10,100,1000 event(s)/sec etc. I understand it relies on the system and the log event content size but just looking for a ball park figure of what is normal.

Thanks in advance.
aje888
New
 
Posts: 2
Joined: Fri Aug 04, 2017 9:41 am

Urgent Question?

  • Pulling out your Hair?
  • Wasting Time and Money?
  • Deadline Approaching?

Re: What happens if remote TCP port is not available

Postby dlang » Fri Aug 04, 2017 9:59 am

If a message cannot be sent via TCP, all log processing (on that queue, the main queue by default) pauses until the message either gets through or fails (see retries to set how many times it tries before giving up)

I have built production systems that handled 100,000 logs/sec, and stripped down benchmarking tests have hit 1,000,000 logs/sec
dlang
Frequent Poster
 
Posts: 1001
Joined: Mon Sep 15, 2008 7:44 am

Re: What happens if remote TCP port is not available

Postby aje888 » Fri Aug 04, 2017 11:01 am

Thanks.

I can see there are various retry and other options that can be defined as part of an 'action'. Is the following short hand for a tcp action? Or is it just old syntax?

local6.* @@server:port

What are the default retry and other options for the above?
aje888
New
 
Posts: 2
Joined: Fri Aug 04, 2017 9:41 am

Re: What happens if remote TCP port is not available

Postby dlang » Fri Aug 04, 2017 11:20 am

yes, that is the legacy format of an action.

When you start setting various options, you probably want to switch to the new action() format to make it clearer as to what is happening

details of options and defaults are on the omfwd doc page (most current is at http://www.rsyslog.com/doc/v8-stable/co ... omfwd.html)
dlang
Frequent Poster
 
Posts: 1001
Joined: Mon Sep 15, 2008 7:44 am

Google Ads



Return to Configuration

Who is online

Users browsing this forum: No registered users and 3 guests

cron