Hi,
I have a UFW running 6.3.2, and I'm seeing the following in my logs on a regular basis. I'm also being told that data is missing...
01-20-2016 21:35:00.859 -0500 INFO TailReader - Continuing...
01-20-2016 21:35:07.025 -0500 INFO TailReader - Could not send data to output queue (structuredParsingQueue), retrying...
01-20-2016 21:35:08.034 -0500 INFO TailReader - Could not send data to output queue (structuredParsingQueue), retrying...
01-20-2016 21:35:08.731 -0500 INFO TailReader - Could not send data to output queue (parsingQueue), retrying...
01-20-2016 21:35:15.383 -0500 INFO TailReader - Continuing...
01-20-2016 21:35:23.161 -0500 INFO TailReader - ...continuing.
01-20-2016 21:35:23.182 -0500 INFO TailReader - Continuing...
01-20-2016 21:35:27.036 -0500 INFO TailReader - Could not send data to output queue (structuredParsingQueue), retrying...
01-20-2016 21:35:29.076 -0500 INFO TcpOutputProc - Closing stream for idx=X.X.X.X:9997
01-20-2016 21:35:29.076 -0500 INFO TcpOutputProc - Connected to idx=X.X.X.X:9997
01-20-2016 21:35:29.863 -0500 INFO TcpOutputProc - Closing stream for idx=X.X.X.X:9997
01-20-2016 21:35:29.863 -0500 INFO TcpOutputProc - Connected to idx=X.X.X.X:9997
01-20-2016 21:35:31.226 -0500 INFO TailReader - Could not send data to output queue (parsingQueue), retrying...
01-20-2016 21:35:35.022 -0500 INFO TailReader - Could not send data to output queue (structuredParsingQueue), retrying...
The Universal forwarder is connecting and load-balancing, but I'm also seeing "could not send data" messages, and I don't know why. When I grabbed this snapshot, the file had not been written to in about 30 minutes, so it's not busy. And the servers listed in the outputs.conf are all reachable and running. (And what is "structuredParsingqueue" anyway?).
Any ideas? There are a lot of files here - they roll over about every 60-90 seconds, once they reach 50mb, so it's very busy during the day (but quiet right now).
↧