On Thu, 28 May 2009, Howard Wilkinson wrote:
Rainer Gerhards wrote:
-----Original Message-----
From: [email protected] [mailto:rsyslog-
[email protected]] On Behalf Of Howard Wilkinson
I have recently installed the 3.22.0 release and found that the
$OptimizeForUniprocessor configuration facility is missing from the
source, is this intentional?
Well... not intentional, but simply not present in v3. This is a v4
feature.
Rainer
In that case can someone tell me what I am doing wrong with this
configuration.
I have 3.22.0 installed on all systems in the network! I have 2 receiving
servers (1 master and one backup) that are contacted via RELP, falling back
to TCP and then UDP if things go wrong. On the receiving servers I log
everything into a replicated MySQL database. This all functions... but the
master server gets further and further behind with the log messages until
things on client boxes start hanging. The logging servers run the MYSQL DB
engines but are only about 25% CPU loaded (load level is 2.1 ish). The
database is stored on a SCSI mirror (U160) and there does not seem to be any
IO overload. So what is going on? Config attached!
can you tell how many inserts/sec you are getting on your MySQL database?
what table type are you using? do you have a battery-backed write cache on
your SCSI controller?
I suspect that your problem is that the database just isn't keeping up
with the inbound data rate, so things queue up until the queue is full,
then things start queueing on the clients.
the only way to fix this is to increase the speed of writing to the
database. options may include
1. tuning MySQL for higher insert rates (possibly including disabling
fsync)
2. improving the disk systems to handle more transactions/sec (enabling a
disk cache will do wonders)
3. increase the number of worker threads so that rsyslog can have multiple
inserts in flight at the same time
4. moving to rsyslog 4 which includes the ability to insert multiple
records in one transaction
David Lang
#rsyslog v3 config file
#### GLOBAL DIRECTIVES ####
# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
# File syncing capability is disabled by default. This feature is usually not
required,
# not useful and an extreme performance hit
#$ActionFileEnableSync on
# An "In-Memory Queue" is created for remote logging.
$WorkDirectory /var/spool/rsyslog # where to place spool files
$ActionQueueFileName queue # unique name prefix for spool files
$ActionQueueMaxDiskSpace 512m # 1gb space limit (use as much as possible)
$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
$ActionQueueType LinkedList # run asynchronously
$ActionResumeRetryCount -1 # infinite retries if host is down
$ActionQueueWorkerThreads 5
$MainMsgQueueSize 100000
$MainMsgQueueWorkerThreads 5
#### MODULES ####
$ModLoad imuxsock.so # provides support for local system logging (e.g. via
logger command)
$ModLoad imklog.so # provides kernel logging support (previously done by
rklogd)
#$ModLoad immark.so # provides --MARK-- message capability
# Reliable Log forwarding Server
$ModLoad imrelp
$InputRELPServerRun 4514
# Provides UDP syslog reception
$ModLoad imudp.so
$UDPServerRun 514
# Provides TCP syslog reception
$ModLoad imtcp.so
$InputTCPServerRun 601
# Enable the database front-end
$ModLoad ommysql.so
#### RULES ####
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.* /dev/console
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none /var/log/messages
# The authpriv file has restricted access.
authpriv.* /var/log/secure
# Log all the mail messages in one place.
mail.* -/var/log/maillog
# Log cron stuff
cron.* /var/log/cron
# Everybody gets emergency messages
*.emerg *
# Save news errors of level crit and higher in a special file.
uucp,news.crit /var/log/spooler
# Save boot messages also to boot.log
local7.* /var/log/boot.log
# Log everything to the database
*.*
:ommysql:barnsbury.finsbury.cohtech.co.uk,Syslog,Syslog,d5Hi9s/Ak
$ActionExecOnlyWhenPreviousIsSuspended on
*.*
:ommysql:barnacle.finsbury.cohtech.co.uk,Syslog,Syslog,d5Hi9s/Ak
$ActionExecOnlyWhenPreviousIsSuspended off
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
