rsyslog

The rocket-fast system for log processing

action.execOnlyWhenPreviousIsSuspended preciseness

The "action.execOnlyWhenPreviousIsSuspended" parameter permits to conditionally execute an action only if the previous one is suspended. When an action actually gets suspended depends on the output module implementing the action, but the general rule is that an action suspends itself if there is a problem doing it’s job (e.g. a target server is down). This setting is generally used to implement failover destinations. So let’s call actions which have this attribute set "failover actions".

Note that many action implement transactions to improve performance. If so, usually the success or error state of the action is only available after the transaction has been comitted. At this point, the messages have already been submitted to the action and the action could not set suspension state — simply because at that point everything looked fine. So when the failover action was about to be executed, the suspended flag was not set and the action not executed. Depending on system configuration, this can lead to loss of some messages during the failover process. If this seems totally unacceptable to you, you need to make sure that the transaction is committed after each message — this permits the output to obtain the actual success state (note that with some technologies, even this is not totally possible – a prime example is plain TCP syslog protocol).

To ensure commit of each message, the queue’s maximum batch size needs to be reduced to one. This can be done via the "queue.dequeuebatchsize" parameter. Note that reducing the batch size can have severe performance impact. Unfortunately, it is impossible to to have both high performance and precise failover actions. The simple reason is that for precise failover actions we need to know the result of the commit operation, which makes it necessary to do immediate commits.

One thought on “action.execOnlyWhenPreviousIsSuspended preciseness

  1. can you post a working sample of the failover implementation ?
    I have been using this model below and rsyslog fails to start.
    it gives me "segmentation error (core dumped)" in debug mode.
    –command–# /sbin/rsyslogd -f /etc/rsyslog.conf -N1

    when i comment out the 2 lines starting with "&", rsyslog starts. but then i am sure the failover is not implemented.
    Please enlighten me.

    ####forwarding rule##################

    $ActionQueueType LinkedList # use asynchronous processing
    $ActionQueueFileName srvrfwd1 # set file name, also enables disk mode
    $ActionResumeRetryCount -1 # infinite retries on insert of failure
    $ActionQueueSaveOnShutdown on # save in-memory data if rsyslog shuts down
    mail.*;local3.* @@192.168.1.1:514
    $ActionExecOnlyWhenPreviousIsSuspended on
    & mail.*;local3.* @@192.168.1.2:514
    & /var/log/localbuffer
    $ActionExecOnlyWhenPreviousIsSuspended off

    ########end of rule##########################

Comments are closed.