Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using rsyslog to get logs from haproxy and put them into logstash for elasticsearch/kibana.

Everything was working ok, but i've found something strange in rsyslog.

I've found that i've got missing data in kibana. The reason is rsyslog.

Queue on disk was held and stopped for some days

So I've got missing data from weekend, but yesterday and today - all is ok.

Rsyslog now gets data and put them in logstash, but he seems to forgot about data stored in his own queue (I think he sees that they are old, and ignore them there is parameter for that, and maybe some default value is used? )

Right now, logstash is idle, i can force to him many additional data from rsyslog queue

So What i want to do is to :

Temporarly try to flush this queue (like postfix flush) or if this is not possible, what should i try to do?

My rsyslog config is:

$ActionSendTCPRebindInterval 500
$ActionQueueType LinkedList
$ActionQueueFileName kibana
$ActionQueueMaxFileSize 100m
$ActionQueueMaxDiskSpace 100g
$ActionQueueTimeoutEnqueue 0
$ActionResumeRetryCount -1
$ActionQueueSaveOnShutdown on
share|improve this question
Normal restart of rsyslog didn't help, but... after changing Dequeue Parameters (they didn't help, but i think they restarted some counter) - and removing them, restart helped, and queue is flushing. – Lisek May 14 '14 at 10:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.