Alert firing indicating a proxy has backlog however reviewing the Tanzu Observability Service and Proxy Data Dashboard you find
Backlog means the proxy is queuing metric points due to various reasons in the spool files on the proxy. If there is an incorrect reading of the spool files, the Proxy Backlog Size Chart will indicate points backlog where there is none.
Confirm if the proxy(s) in question actually has data backlogged by:
Dashboard and Charts - Various charts on the below dashboard track pps flowing from the proxies to Wavefront back-end
Dashboard: Tanzu Observability Service and Proxy Data
Section: Proxies: Overview,
Charts: Proxy Backlog Size, Queuing Reasons
The above findings indicate a false reading of backlog, continue below for additional investigations
Proxy Logs - Review the proxy logs /var/log/wavefront/wavefront.log, for entries that indicate problems:
Review the proxy logs for changing tasks and points values. Confirming they are changing with no errors regarding being unable to transmit/retransmit indicates the proxy is processing data.
<epoch time> INFO [QueueController:printQueueStats] [2878.central] points backlog status: 14 tasks, 2487020 points
<epoch time> INFO [QueueController:printQueueStats] [2878.central] points backlog status: 31 tasks, 2526310 points
<epoch time> INFO [QueueController:printQueueStats] [2878.central] points backlog status: 26 tasks, 2589618 points
<epoch time> INFO [QueueController:printQueueStats] [2878.central] points backlog status: 39 tasks, 2546892 points
With no errors seen in the proxy logs and the number of tasks and points changing the proxy is able to communicate with Wavefront backend and deliver its data. Continue below for additional investigations.
Review of Pod Proxy /var/spool/wavefront-proxy/ spool files size shows they are empty.
Empty buffer (spool) files sizes for each type of proxy deployment.
Spool files on a Standard Proxy
du -ah /var/spool/wavefront-proxy/If the spool files(s) are 4096 in size, this indicates no data is stored within the file.
Some or All spool files are larger in size than 4096, the file(s) contain data. Next Action - Investigate to discover other issues why backlog is not clearing.
Spool files in a Container Proxy.
If all spool files on are 80k in size, this indicates no data is stored within the file.
Some or All spool files are larger in size than 80k the file(s) contain data. Next Action - Investigate to discover other issues why backlog is not clearing.
Spool files when Persistent Volume Storage is used for the Containered Proxy.
Check the yaml of the proxy pod to see where the PV is mounted
If all spool files on are 80k in size, this indicates no data is stored within the file.
Some or All spool files are larger in size than 80k the file(s) contain data. Next Action - Investigate to discover other issues why backlog is not clearing.
Conclusion
The spool files hold the actual data until it can be successfully transmitted to Wavefront back-end. If the files are empty, there is a false reading within Wavefront Charts.
Reboot the Proxy to confirm if this clears the backlog.
For further assistance, please contact Broadcom Support.
See Proxy Troubleshooting Section: Manage the Proxy Queue