One thing that came to my mind is imfile. I know that we had issues with some older version that continued to send data ever and ever again under some circumstances. Was fixed half a year to a year ago, the ChangeLog should tell you the exact version.
Rainer > -----Original Message----- > From: rsyslog-boun...@lists.adiscon.com [mailto:rsyslog- > boun...@lists.adiscon.com] On Behalf Of da...@lang.hm > Sent: Tuesday, February 21, 2012 12:37 AM > To: rsyslog-users > Subject: Re: [rsyslog] Log Storm > > are you sure the sender didn't send you duplicate logs? > > the only type of thing that I can think of that would cause this on the > receiver side is if you have an action that started to fail, in that > case > I think that rsyslog is going to retry (and depending on your retry and > throttling limits, it may do so a LOT) > > David Lang > > On Mon, 20 Feb 2012, Jeff Poling wrote: > > > Seems to be duplicates of normal logs. I saved a couple of the logs > and they include entries all from the same time down to the seconds. > > > > Jeff > > > > Jeffrey Poling > > System Administrator | Information Systems > > Moody Bible Institute > > 820 N. LaSalle Blvd., Chicago, IL 60610 > > 312-329-8968 > > www.moodyministries.net > > From the Word. To Life. > > > > > >> -----Original Message----- > >> From: rsyslog-boun...@lists.adiscon.com [mailto:rsyslog- > >> boun...@lists.adiscon.com] On Behalf Of Radu Gheorghe > >> Sent: Monday, February 20, 2012 9:51 AM > >> To: rsyslog-users > >> Subject: Re: [rsyslog] Log Storm > >> > >> Hi Jeff, > >> > >> How do the "excessive logs" look like? Are they garbage, or > duplicates of > >> "normal" logs? > >> > >> Best regards, > >> Radu > >> > >> 2012/2/20 Jeff Poling <jpol...@moody.edu> > >> > >>> I am kind of at the end of my rope on this one, so I thought I > would > >>> ask the community. I don't have a lot of information, but last > week > >>> we had an incident on our rsyslog collector system. Essentially, > the > >>> disk space in the file system where we keep the log files filled > up. > >>> The rsyslog spool area filled up as well. What seemed to cause > this > >>> were several systems that began logging excessively - 30+ GB log > files > >> within minutes. > >>> > >>> I was able to add some disk space and stop rsyslog on systems that > >>> were problematic; however, I simply cannot tell why the incident > >> happened. > >>> > >>> Has anyone seen this type of behavior with rsyslog? On our > collector > >>> system we are running v. 5.8.5. We are still migrating our client > >>> systems to 5.8.5 so most of them are still at 5.4.0 of rsyslog. > >>> > >>> Any experiences or insight is greatly appreciated. > >>> > >>> Thanks, > >>> > >>> Jeff > >>> > >>> Jeffrey Poling > >>> System Administrator | Information Systems Moody Bible Institute > >>> 820 N. LaSalle Blvd., Chicago, IL 60610 > >>> 312-329-8968 > >>> www.moodyministries.net<http://www.moodyministries.net> > >>> From the Word. To Life. > >>> > >>> _______________________________________________ > >>> rsyslog mailing list > >>> http://lists.adiscon.net/mailman/listinfo/rsyslog > >>> http://www.rsyslog.com/professional-services/ > >>> > >> _______________________________________________ > >> rsyslog mailing list > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > >> http://www.rsyslog.com/professional-services/ > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/
