I'm trying to setup a robust AF_UNIX data transfer.
So I make this test (on a Ubuntu 20.04):I generate logs :
for a in `seq 1 1000000`; do echo $a | logger; echo $a ; done
I check my log file :
tail -f /var/log/syslog | less
I can see my logs logged by rsyslog in this file.
I stop rsyslog :
systemctl stop syslog.socket
No logs arrived anymore in /var/log/syslog as expected.
But when I restart rsyslog :
systemctl stop syslog.socket
I can see that the logs arrvie again but most of the one created during the rsyslog outage are missing.
I tired to increase the max_dgram_qlen
echo 5000000 > /proc/sys/net/unix/max_dgram_qlen
but it doesn't change anything.
I read on this post What is the max size of AF_UNIX datagram message in Linux? that I can monitor the socket using:
ss -ax | grep log
but the counters looked to be at zero all the time whether rsyslog is started or not.
What I trying to do :
- increase the buffer to be able to have at least 500MB or 500,000 messages in queue
- be able to monitor the size of the queue : size or queue length
- if possible logging in dmesg when messages are dropped.