On Tue, Nov 15, 2022 at 03:59:36PM +0000, Eric Wilkison wrote:
> Syslog can drop the logs under heavy load. Look for these logs to confirm:
>
> xxx messages lost due to rate-limiting
>
> Add to rsyslog.conf to disable rate limiting (assuming your using imjournal):
>
> $imjournalRatelimitInterval 0
> $imjournalRatelimitBurst 0
If rsyslogd is downstream of systemd-journald, this may not help, the
rate limits are often in systemd-journald, which also has the misfeature
of using a stream rather than dgram log socket and so sometimes reorders
log messages received over separate channels.
On some systems the simplest reasonable solution is "postlog".
--
Viktor.
