My debug was about 200MB but here is most of the lines that contained the
word error. It seems like most of them are actual messages, in which case
I'm still not sure why I'm not getting all my logs.

lmarrottMBP:Downloads lmarrott$ cat ./rsyslogdebug.txt | grep error
8064.318695324:7f47e1f20700: Command 'errormessagestostderr':
8071.284459711:7f47d97fb700: recv(4,257),acl:1,msg:<164>Nov 29 2012
09:54:30: %ASA-4-313005: No matching connection for ICMP error message:
icmp src outside:<PUBLIC IP> dst outside:<PUBLIC IP> (type 3, code 1) on
outside interface.  Original IP payload: udp src <PUBLIC IP>/<AS> dst
<PRIVATE IP>/<AS>.
8073.282005100:7f47d97fb700: recv(4,143),acl:1,msg:<131>HOST:
*ethoipSocketTask: Nov 29 08:54:32.487: %ETHOIP-3-PKT_RECV_ERROR:
ethoip.c:338 ethoipSocketTask: ethoipRecvPkt returned errorember:0.0.0.0.
source member unknown.with invalid SPA(Source IP Address) <PRIVATE
IP>/TPA(Destination IP Address) <PRIVATE IP>KlA==
8075.329472799:7f47d97fb700: recv(4,254),acl:1,msg:<164>Nov 29 2012
09:54:34: %ASA-4-313005: No matching connection for ICMP error message:
icmp src outside:<PUBLIC IP> dst outside:<PUBLIC IP> (type 3, code 1) on
outside interface.  Original IP payload: udp src <PUBLIC IP>/15637 dst
<PRIVATE IP>/37.
8075.425051462:7f47d97fb700: recv(4,120),acl:1,msg:<131>HOST: *SISF BT
Process: Nov 29 09:54:38.193: %SISF-3-INTERNAL: sisf_shim_utils.c:316
Internal error, 0 length0::7ec5:37ff:fe76:698d V=499 I=wireless:0 P=0005
M=ST) received with invalid SPA(Source IP Address)
172.24.13.60/TPA(Destination IP Address) <PRIVATE
IP>2.24.0.1reless,0x41C04FEC 0x41C057CC 0x41C0583C 0x429735D4 0x4034E898
0x41C03A1C
0x41C02E74????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
 
???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
8080.405977456:7f47d97fb700: recv(4,154),acl:1,msg:<170>781802: 754500: Nov
29 16:54:37.388 UTC: %PM_SCP-SP-2-LCP_FW_ERR_INFORM: Module 9 is
experiencing the following error: Bus Asic #0 out of sync error ARP (op ARP
REQUEST) received with invalid SPA(Source IP Address)
172.24.3.123/TPA(Destination IP Address) <PRIVATE IP>ault Group,t occurred
2 C 0x41C057CC 0x41C0583C 0x429735D4 0x4034E898 0x41C03A1C
0x41C02E74????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
 
???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
8088.573347906:7f47e107f700: msg parser: flags 70, from '~NOTRESOLVED~',
msg '<172>1044733: L2 cache data errors = 0'
8088.573418280:7f47e107f700: msg parser: flags 70, from '~NOTRESOLVED~',
msg '<172>1044734: L2 cache tag errors = 0'
8088.573489139:7f47e107f700: msg parser: flags 70, from '~NOTRESOLVED~',
msg '<172>1044735: Memory data errors = 255'
8093.282068663:7f47d97fb700: recv(4,143),acl:1,msg:<131>HOST:
*ethoipSocketTask: Nov 29 08:54:52.487: %ETHOIP-3-PKT_RECV_ERROR:
ethoip.c:338 ethoipSocketTask: ethoipRecvPkt returned error0.4.20, not from
a mobility peer62)
8093.284930681:7f47d97fb700: recv(4,123),acl:1,msg:<134>HOST:
*webauthRedirect: Nov 29 09:54:56.053: %EMWEB-6-REQ_NOT_GET_ERR:
http_parser.c:615 http request is not GETcvPkt returned error0.4.20, not
from a mobility peer62)
8103.282351260:7f47d97fb700: recv(4,143),acl:1,msg:<131>HOST:
*ethoipSocketTask: Nov 29 08:55:02.487: %ETHOIP-3-PKT_RECV_ERROR:
ethoip.c:338 ethoipSocketTask: ethoipRecvPkt returned errorember:0.0.0.0.
source member unknown.26025)
8113.282199074:7f47d97fb700: recv(4,143),acl:1,msg:<131>HOST:
*ethoipSocketTask: Nov 29 08:55:12.487: %ETHOIP-3-PKT_RECV_ERROR:
ethoip.c:338 ethoipSocketTask: ethoipRecvPkt returned error0.4.20, not from
a mobility peer)
8116.186986131:7f47d97fb700: recv(4,154),acl:1,msg:<170>781811: 754509: Nov
29 16:55:13.409 UTC: %PM_SCP-SP-2-LCP_FW_ERR_INFORM: Module 9 is
experiencing the following error: Bus Asic #0 out of sync error rsed = 4
and bytes read = 166
8116.192440101:7f47d97fb700: recv(4,123),acl:1,msg:<134>HOST:
*webauthRedirect: Nov 29 09:55:18.965: %EMWEB-6-REQ_NOT_GET_ERR:
http_parser.c:615 http request is not GET Bus Asic #0 out of sync error
rsed = 4 and bytes read = 166
8123.284403588:7f47d97fb700: recv(4,143),acl:1,msg:<131>HOST:
*ethoipSocketTask: Nov 29 08:55:22.487: %ETHOIP-3-PKT_RECV_ERROR:
ethoip.c:338 ethoipSocketTask: ethoipRecvPkt returned error0.4.20, not from
a mobility peerad = 166)
8123.284463300:7f47d97fb700: recv(4,123),acl:1,msg:<134>HOST:
*webauthRedirect: Nov 29 09:55:26.058: %EMWEB-6-REQ_NOT_GET_ERR:
http_parser.c:615 http request is not GETcvPkt returned error0.4.20, not
from a mobility peerad = 166)
8133.923756513:7f47d97fb700: recv(4,154),acl:1,msg:<170>781816: 754514: Nov
29 16:55:31.401 UTC: %PM_SCP-SP-2-LCP_FW_ERR_INFORM: Module 9 is
experiencing the following error: Bus Asic #0 out of sync error rsed = 4
and bytes read = 16610)
8143.282501959:7f47d97fb700: recv(4,143),acl:1,msg:<131>HOST:
*ethoipSocketTask: Nov 29 08:55:42.487: %ETHOIP-3-PKT_RECV_ERROR:
ethoip.c:338 ethoipSocketTask: ethoipRecvPkt returned error0.4.20, not from
a mobility peer58)
8148.570657822:7f47d97fb700: recv(4,108),acl:1,msg:<172>1044737: 337580:
Nov 29 16:55:46.563 UTC: %BCM-4-COR_ECC_HIGH: High correctable ECC error
rate detected/443 (<PUBLIC IP>/443) to inside:<PRIVATE IP>/<AS> (<PUBLIC
IP>/<AS>)
8148.570732499:7f47d97fb700: recv(4,38),acl:1,msg:<172>1044738: L2 cache
data errors = 0563 UTC: %BCM-4-COR_ECC_HIGH: High correctable ECC error
rate detected/443 (<PUBLIC IP>/443) to inside:<PRIVATE IP>/<AS> (<PUBLIC
IP>/<AS>)
8148.570893783:7f47d97fb700: recv(4,37),acl:1,msg:<172>1044739: L2 cache
tag errors = 00563 UTC: %BCM-4-COR_ECC_HIGH: High correctable ECC error
rate detected/443 (<PUBLIC IP>/443) to inside:<PRIVATE IP>/<AS> (<PUBLIC
IP>/<AS>)
8148.571080028:7f47d97fb700: recv(4,38),acl:1,msg:<172>1044740: Memory data
errors = 255563 UTC: %BCM-4-COR_ECC_HIGH: High correctable ECC error rate
detected/443 (<PUBLIC IP>/443) to inside:<PRIVATE IP>/<AS> (<PUBLIC
IP>/<AS>)
8148.571280432:7f47d97fb700: recv(4,14),acl:1,msg:<172>1044741: Memory data
errors = 255563 UTC: %BCM-4-COR_ECC_HIGH: High correctable ECC error rate
detected/443 (<PUBLIC IP>/443) to inside:<PRIVATE IP>/<AS> (<PUBLIC
IP>/<AS>)
8153.282595590:7f47d97fb700: recv(4,143),acl:1,msg:<131>HOST:
*ethoipSocketTask: Nov 29 08:55:52.487: %ETHOIP-3-PKT_RECV_ERROR:
ethoip.c:338 ethoipSocketTask: ethoipRecvPkt returned error0.4.20, not from
a mobility peer969)
8156.882482752:7f47d97fb700: recv(4,108),acl:1,msg:<165>Nov 29 2012
09:55:56: %ASA-5-304001: <PRIVATE IP> Accessed URL <PUBLIC
IP>:/images/icons/error_x.gif
8169.737485853:7f47e107f700: msg parser: flags 70, from '~NOTRESOLVED~',
msg '<172>1044738: L2 cache data errors = 0'
8169.737581030:7f47e107f700: msg parser: flags 70, from '~NOTRESOLVED~',
msg '<172>1044739: L2 cache tag errors = 0'
8169.737642363:7f47e107f700: msg parser: flags 70, from '~NOTRESOLVED~',
msg '<172>1044740: Memory data errors = 255'
8169.911301929:7f47d97fb700: recv(4,154),acl:1,msg:<170>781826: 754524: Nov
29 16:56:07.413 UTC: %PM_SCP-SP-2-LCP_FW_ERR_INFORM: Module 9 is
experiencing the following error: Bus Asic #0 out of sync error es 71455
TCP FINs
8172.810010498:7f47d97fb700: recv(4,141),acl:1,msg:<172>3926398: 3921147:
Nov 29 16:56:11.292 UTC: %PM-SP-4-ERR_DISABLE: bpduguard error detected on
Gi6/44, putting Gi6/44 in err-disable stateeved file
461_message_2012-11-29_084210.xml
8173.282806737:7f47d97fb700: recv(4,143),acl:1,msg:<131>HOST:
*ethoipSocketTask: Nov 29 08:56:12.488: %ETHOIP-3-PKT_RECV_ERROR:
ethoip.c:338 ethoipSocketTask: ethoipRecvPkt returned error0.4.20, not from
a mobility peer
8188.442442397:7f47d97fb700: recv(4,154),acl:1,msg:<170>781831: 754529: Nov
29 16:56:25.431 UTC: %PM_SCP-SP-2-LCP_FW_ERR_INFORM: Module 9 is
experiencing the following error: Bus Asic #0 out of sync error es 0 TCP
FINs
8190.749818590:7f47e1f20700: main Q: error -7 persisting queue - data lost!


:Luke Marrott



On Thu, Nov 29, 2012 at 11:12 AM, David Lang <da...@lang.hm> wrote:

> any errors :-)
>
> go ahead and past pieces inline.
>
> David Lang
>
>
> On Thu, 29 Nov 2012, Luke Marrott wrote:
>
>  Which parts of the debug would be the most beneficial? Should I attach it
>> or paste pieces inline?
>>
>> :Luke Marrott
>>
>>
>>
>> On Mon, Nov 19, 2012 at 7:11 PM, David Lang <da...@lang.hm> wrote:
>>
>>  On Mon, 19 Nov 2012, Luke Marrott wrote:
>>>
>>>  So I have been trying to figure this out. Went through the config and
>>> got
>>>
>>>> rid of everything that I wasn't using or was commented out from the
>>>> default
>>>> template and it's still not getting as much as Splunk is getting so it
>>>> has
>>>> to be something with my installation or my configuration.
>>>>
>>>> I ran the config check -N 1 and here is the output:
>>>> [root@nwcacti lmarrott]# /usr/local/sbin/rsyslogd -f /etc/rsyslog.conf
>>>> -n
>>>> -N 1
>>>> rsyslogd: version 5.8.10, config validation run (level 1), master config
>>>> /etc/rsyslog.conf
>>>> rsyslogd: WARNING: rsyslogd is running in compatibility mode.
>>>> Automatically
>>>> generated config directives may interfer with your rsyslog.conf
>>>> settings.
>>>> We suggest upgrading your config and adding -c5 as the first rsyslogd
>>>> option.
>>>> rsyslogd: Warning: backward compatibility layer added to following
>>>> directive to rsyslog.conf: ModLoad immark
>>>> rsyslogd: Warning: backward compatibility layer added to following
>>>> directive to rsyslog.conf: MarkMessagePeriod 1200
>>>> rsyslogd: Warning: backward compatibility layer added to following
>>>> directive to rsyslog.conf: ModLoad imuxsock
>>>> rsyslogd: End of config validation run. Bye.
>>>>
>>>>
>>>> How do I upgrade my config?
>>>>
>>>> I also ran a debug and it seems like there are a lot of things it's
>>>> complaining about. But then again maybe it's normal.
>>>>
>>>>
>>> start rsyslog with -c5 to avoid this particular error
>>>
>>> If you can send us the debug log (with the -c5) we can look at the errors
>>> that show up, but I suspect that things will work a LOT better for you
>>> with
>>> the -c5
>>>
>>> David Lang
>>>
>>>
>>>  :Luke Marrott
>>>>
>>>>
>>>>
>>>> On Fri, Nov 9, 2012 at 5:02 PM, David Lang <da...@lang.hm> wrote:
>>>>
>>>>  I'm not sure exactly what will happen, but I suspect that all the logs
>>>>
>>>>> will end up in all the possible destinations. I don't think rsyslog
>>>>> really
>>>>> will process all the local logs to one set of rules and all the remote
>>>>> logs
>>>>> to another set of rules
>>>>>
>>>>>
>>>>> At least, not unless you are using rulesets, which I am not seeing.
>>>>>
>>>>>
>>>>> a couple thousand log messages/sec should not cause any problems.
>>>>>
>>>>>
>>>>> David Lang
>>>>>
>>>>>  On Fri, 9 Nov 2012, Luke Marrott wrote:
>>>>>
>>>>>  Date: Fri, 9 Nov 2012 15:14:32 -0700
>>>>>
>>>>>
>>>>>> From: Luke Marrott <luke.marr...@gmail.com>
>>>>>> Reply-To: rsyslog-users <rsyslog@lists.adiscon.com>
>>>>>> To: rsyslog-users <rsyslog@lists.adiscon.com>
>>>>>> Subject: Re: [rsyslog] rsyslog dropping logs
>>>>>>
>>>>>> Only one configuration there.
>>>>>>
>>>>>> I have all my messages going to directories by host so your method
>>>>>> doesn't
>>>>>> seem to be working.
>>>>>>
>>>>>> I did a tcpdump only on port 514 for a few seconds and I had like 2000
>>>>>> messages.
>>>>>>
>>>>>> :Luke Marrott
>>>>>>
>>>>>>
>>>>>>
>>>>>> On Fri, Nov 9, 2012 at 2:48 PM, David Lang <da...@lang.hm> wrote:
>>>>>>
>>>>>>  are these two different configs (the sender and the receiver)?
>>>>>>
>>>>>>
>>>>>>> a simple way to see the message rate is to do a
>>>>>>> cut -f 1 -d ' ' logfiles |sort |uniq -c to look at the timestamps and
>>>>>>> see
>>>>>>> how many timestamps you have in a second.
>>>>>>>
>>>>>>> David Lang
>>>>>>>
>>>>>>>
>>>>>>> On Fri, 9 Nov 2012, Luke Marrott wrote:
>>>>>>>
>>>>>>>  Date: Fri, 9 Nov 2012 13:07:02 -0700
>>>>>>>
>>>>>>>  From: Luke Marrott <luke.marr...@gmail.com>
>>>>>>>
>>>>>>>> Reply-To: rsyslog-users <rsyslog@lists.adiscon.com>
>>>>>>>> To: rsyslog-users <rsyslog@lists.adiscon.com>
>>>>>>>>
>>>>>>>> Subject: Re: [rsyslog] rsyslog dropping logs
>>>>>>>>
>>>>>>>> Full configuration:
>>>>>>>> [root@hostname]# cat /etc/rsyslog.conf
>>>>>>>> # if you experience problems, check
>>>>>>>> # 
>>>>>>>> http://www.rsyslog.com/********troubleshoot<http://www.rsyslog.com/******troubleshoot>
>>>>>>>> <http://www.**rsyslog.com/****troubleshoot<http://www.rsyslog.com/****troubleshoot>
>>>>>>>> >
>>>>>>>> <http://www.**rsyslog.com/****troubleshoot<http://rsyslog.com/**troubleshoot>
>>>>>>>> <http://www.**rsyslog.com/**troubleshoot<http://www.rsyslog.com/**troubleshoot>
>>>>>>>> >
>>>>>>>>
>>>>>>>>>
>>>>>>>>>  
>>>>>>>>> <http://www.**rsyslog.com/****troubleshoot<http://rsyslog.com/**troubleshoot>
>>>>>>>> <http://rsyslog.**com/troubleshoot<http://rsyslog.com/troubleshoot>
>>>>>>>> >
>>>>>>>>
>>>>>>>> <http://www.**rsyslog.com/**troubleshoot<http://rsyslog.com/troubleshoot>
>>>>>>>> <http://www.**rsyslog.com/troubleshoot<http://www.rsyslog.com/troubleshoot>
>>>>>>>> >
>>>>>>>>
>>>>>>>>> for
>>>>>>>>>>
>>>>>>>>>
>>>>>>>> assistance
>>>>>>>>
>>>>>>>>
>>>>>>>> # rsyslog v3: load input modules
>>>>>>>> # If you do not load inputs, nothing happens!
>>>>>>>> # You may need to set the module load path if modules are not found.
>>>>>>>>
>>>>>>>> $ModLoad immark   # provides --MARK-- message capability
>>>>>>>> $ModLoad imuxsock # provides support for local system logging (e.g.
>>>>>>>> via
>>>>>>>> logger command)
>>>>>>>> $ModLoad imklog   # kernel logging (formerly provided by rklogd)
>>>>>>>>
>>>>>>>> # Log all kernel messages to the console.
>>>>>>>> # Logging much else clutters up the screen.
>>>>>>>> #kern.*                                                 /dev/console
>>>>>>>>
>>>>>>>> # Log anything (except mail) of level info or higher.
>>>>>>>> # Don't log private authentication messages!
>>>>>>>> #*.error;mail.none;authpriv.********none;cron.none
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>>  /var/log/messages
>>>>>>>>
>>>>>>>> # The authpriv file has restricted access.
>>>>>>>> authpriv.*
>>>>>>>>  /var/log/secure
>>>>>>>>
>>>>>>>> # Log all the mail messages in one place.
>>>>>>>> mail.*
>>>>>>>>  -/var/log/maillog
>>>>>>>>
>>>>>>>>
>>>>>>>> # Log cron stuff
>>>>>>>> cron.*
>>>>>>>>  -/var/log/cron
>>>>>>>>
>>>>>>>> # Everybody gets emergency messages
>>>>>>>> *.emerg                                                 *
>>>>>>>>
>>>>>>>> # Save news errors of level crit and higher in a special file.
>>>>>>>> uucp,news.crit
>>>>>>>>  -/var/log/spooler
>>>>>>>>
>>>>>>>> # Save boot messages also to boot.log
>>>>>>>> local7.*
>>>>>>>>  /var/log/boot.log
>>>>>>>>
>>>>>>>> # Remote Logging (we use TCP for reliable delivery)
>>>>>>>> # An on-disk queue is created for this action. If the remote host is
>>>>>>>> # down, messages are spooled to disk and sent when it is up again.
>>>>>>>> #$WorkDirectory /rsyslog/spool # where to place spool files
>>>>>>>> #$ActionQueueFileName uniqName # unique name prefix for spool files
>>>>>>>> #$ActionQueueMaxDiskSpace 1g   # 1gb space limit (use as much as
>>>>>>>> possible)
>>>>>>>> #$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
>>>>>>>> #$ActionQueueType LinkedList   # run asynchronously
>>>>>>>> #$ActionResumeRetryCount -1    # infinite retries if host is down
>>>>>>>> # remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
>>>>>>>> #*.* @@remote-host:514
>>>>>>>>
>>>>>>>>
>>>>>>>> # ######### Receiving Messages from Remote Hosts ##########
>>>>>>>> # TCP Syslog Server:
>>>>>>>> # provides TCP syslog reception and GSS-API (if compiled to support
>>>>>>>> it)
>>>>>>>> $ModLoad imtcp.so  # load module
>>>>>>>> $InputTCPServerRun 514 # start up TCP listener at port 514
>>>>>>>>
>>>>>>>> # UDP Syslog Server:
>>>>>>>> $ModLoad imudp.so  # provides UDP syslog reception
>>>>>>>> $UDPServerRun 514 # start a UDP syslog server at standard port 514
>>>>>>>>
>>>>>>>>
>>>>>>>> $template Default,"/data/syslog/%********HOSTNAME%/%HOSTNAME%.log"
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>> *.* ?Default
>>>>>>>>
>>>>>>>>
>>>>>>>> [root@hostname]#
>>>>>>>>
>>>>>>>>
>>>>>>>> What's a good way to look at message ratE?
>>>>>>>>
>>>>>>>>
>>>>>>>> :Luke Marrott
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>> On Fri, Nov 9, 2012 at 1:03 PM, David Lang <da...@lang.hm> wrote:
>>>>>>>>
>>>>>>>>  On Fri, 9 Nov 2012, Luke Marrott wrote:
>>>>>>>>
>>>>>>>>
>>>>>>>>   Sorry. I wasn't real clear. The server runs on a big VM in another
>>>>>>>>>
>>>>>>>>>  location
>>>>>>>>>
>>>>>>>>>  completely. No issues with the server during this time. This has
>>>>>>>>>> been
>>>>>>>>>> an
>>>>>>>>>> ongoing thing. I'm running Splunk on the same box and if I turn
>>>>>>>>>> off
>>>>>>>>>> rsyslog
>>>>>>>>>> and turn splunk on the same port it gets all the messages that
>>>>>>>>>> don't
>>>>>>>>>> seem
>>>>>>>>>> to get picked up by rsyslog.
>>>>>>>>>>
>>>>>>>>>> Doesn't appear to be any rate limiting configuration.
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>  Ok, that is a different situation. In my experience, rsyslog is
>>>>>>>>>>
>>>>>>>>>>  signicantly better than Splunk at receiving messages. I've
>>>>>>>>> testing
>>>>>>>>> rsyslog
>>>>>>>>> up to 380K messages/sec (gige wire speed) and others have tested
>>>>>>>>> rsyslog
>>>>>>>>> up
>>>>>>>>> to 1M messages/sec, so it's unlikely to be something fundamental to
>>>>>>>>> rsyslog, but it could easily be some resource contraint you are
>>>>>>>>> running
>>>>>>>>> into.
>>>>>>>>>
>>>>>>>>> can you post your full configuration?
>>>>>>>>>
>>>>>>>>> what message rate are you seeing?
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> David Lang
>>>>>>>>> ______________________________**********_________________
>>>>>>>>> rsyslog mailing list
>>>>>>>>> http://lists.adiscon.net/**********mailman/listinfo/rsyslog<http://lists.adiscon.net/********mailman/listinfo/rsyslog>
>>>>>>>>> <ht**tp://lists.adiscon.net/********mailman/listinfo/rsyslog<http://lists.adiscon.net/******mailman/listinfo/rsyslog>
>>>>>>>>> >
>>>>>>>>> <http**://lists.adiscon.net/********mailman/listinfo/rsyslog<http://lists.adiscon.net/******mailman/listinfo/rsyslog>
>>>>>>>>> <h**ttp://lists.adiscon.net/******mailman/listinfo/rsyslog<http://lists.adiscon.net/****mailman/listinfo/rsyslog>
>>>>>>>>> >
>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>  
>>>>>>>>>> <http:**//lists.adiscon.net/******mailman/**listinfo/rsyslog<http://lists.adiscon.net/****mailman/**listinfo/rsyslog>
>>>>>>>>> <h**ttp://lists.adiscon.net/****mailman/**listinfo/rsyslog<http://lists.adiscon.net/**mailman/**listinfo/rsyslog>
>>>>>>>>> >
>>>>>>>>> <htt**p://lists.adiscon.net/******mailman/listinfo/rsyslog<http://lists.adiscon.net/****mailman/listinfo/rsyslog>
>>>>>>>>> <htt**p://lists.adiscon.net/****mailman/listinfo/rsyslog<http://lists.adiscon.net/**mailman/listinfo/rsyslog>
>>>>>>>>> >
>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>
>>>>>>>>>>  
>>>>>>>>>> <http:**//lists.adiscon.net/******mailman/**listinfo/rsyslog<http://lists.adiscon.net/****mailman/**listinfo/rsyslog>
>>>>>>>>>> <h**ttp://lists.adiscon.net/****mailman/**listinfo/rsyslog<http://lists.adiscon.net/**mailman/**listinfo/rsyslog>
>>>>>>>>>> >
>>>>>>>>>>
>>>>>>>>> <htt**p://lists.adiscon.net/**mailman/****listinfo/rsyslog<http://lists.adiscon.net/mailman/****listinfo/rsyslog>
>>>>>>>>> <h**ttp://lists.adiscon.net/**mailman/**listinfo/rsyslog<http://lists.adiscon.net/mailman/**listinfo/rsyslog>
>>>>>>>>> >
>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>  
>>>>>>>>>> <htt**p://lists.adiscon.net/****mailman/**listinfo/rsyslog<http://lists.adiscon.net/**mailman/**listinfo/rsyslog>
>>>>>>>>> <htt**p://lists.adiscon.net/mailman/****listinfo/rsyslog<http://lists.adiscon.net/mailman/**listinfo/rsyslog>
>>>>>>>>> >
>>>>>>>>> <htt**p://lists.adiscon.net/**mailman/**listinfo/rsyslog<http://lists.adiscon.net/mailman/**listinfo/rsyslog>
>>>>>>>>> <htt**p://lists.adiscon.net/mailman/**listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog>
>>>>>>>>> >
>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>   
>>>>>>>>> http://www.rsyslog.com/**********professional-services/<http://www.rsyslog.com/********professional-services/>
>>>>>>>>>> <http:/**/www.rsyslog.com/********professional-services/<http://www.rsyslog.com/******professional-services/>
>>>>>>>>>> >
>>>>>>>>>> <http://**www.rsyslog.com/********professional-services/<http://www.rsyslog.com/******professional-services/>
>>>>>>>>>> <http:**//www.rsyslog.com/******professional-services/<http://www.rsyslog.com/****professional-services/>
>>>>>>>>>> >
>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>  
>>>>>>>>>> <http://**www.rsyslog.com/********professional-services/<http://www.rsyslog.com/******professional-services/>
>>>>>>>>> <http:**//www.rsyslog.com/******professional-services/<http://www.rsyslog.com/****professional-services/>
>>>>>>>>> >
>>>>>>>>> <http://**www.rsyslog.com/******professional-services/<http://www.rsyslog.com/****professional-services/>
>>>>>>>>> <http://**www.rsyslog.com/****professional-services/<http://www.rsyslog.com/**professional-services/>
>>>>>>>>> >
>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>
>>>>>>>>>>  
>>>>>>>>>> <http://**www.rsyslog.com/******professional-**services/<http://www.rsyslog.com/****professional-**services/>
>>>>>>>>>> <http:**//www.rsyslog.com/****professional-**services/<http://www.rsyslog.com/**professional-**services/>
>>>>>>>>>> >
>>>>>>>>>>
>>>>>>>>> <http:**//www.rsyslog.com/****professional-**services/<http://www.rsyslog.com/**professional-**services/>
>>>>>>>>> <http:**//www.rsyslog.com/**professional-**services/<http://www.rsyslog.com/professional-**services/>
>>>>>>>>> >
>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>  
>>>>>>>>>> <http:**//www.rsyslog.com/******professional-services/<http://www.rsyslog.com/****professional-services/>
>>>>>>>>> <http://**www.rsyslog.com/****professional-services/<http://www.rsyslog.com/**professional-services/>
>>>>>>>>> >
>>>>>>>>>
>>>>>>>>> <http://**www.rsyslog.com/**professional-**services/<http://www.rsyslog.com/professional-**services/>
>>>>>>>>> <http:**//www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/>
>>>>>>>>> >
>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>
>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>
>>>>>>>>>   What's up with rsyslog? Follow https://twitter.com/rgerhards
>>>>>>>>>>
>>>>>>>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>>>>>>>>> myriad
>>>>>>>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if
>>>>>>>>> you
>>>>>>>>> DON'T LIKE THAT.
>>>>>>>>>
>>>>>>>>>  ______________________________********_________________
>>>>>>>>>
>>>>>>>>>  rsyslog mailing list
>>>>>>>>>
>>>>>>>> http://lists.adiscon.net/********mailman/listinfo/rsyslog<http://lists.adiscon.net/******mailman/listinfo/rsyslog>
>>>>>>>> <http**://lists.adiscon.net/******mailman/listinfo/rsyslog<http://lists.adiscon.net/****mailman/listinfo/rsyslog>
>>>>>>>> >
>>>>>>>> <http:**//lists.adiscon.net/****mailman/**listinfo/rsyslog<http://lists.adiscon.net/**mailman/**listinfo/rsyslog>
>>>>>>>> <htt**p://lists.adiscon.net/****mailman/listinfo/rsyslog<http://lists.adiscon.net/**mailman/listinfo/rsyslog>
>>>>>>>> >
>>>>>>>>
>>>>>>>>>
>>>>>>>>>  
>>>>>>>>> <http:**//lists.adiscon.net/****mailman/**listinfo/rsyslog<http://lists.adiscon.net/**mailman/**listinfo/rsyslog>
>>>>>>>> <htt**p://lists.adiscon.net/mailman/****listinfo/rsyslog<http://lists.adiscon.net/mailman/**listinfo/rsyslog>
>>>>>>>> >
>>>>>>>> <htt**p://lists.adiscon.net/**mailman/**listinfo/rsyslog<http://lists.adiscon.net/mailman/**listinfo/rsyslog>
>>>>>>>> <htt**p://lists.adiscon.net/mailman/**listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog>
>>>>>>>> >
>>>>>>>>
>>>>>>>>>
>>>>>>>>>
>>>>>>>>
>>>>>>>>>  
>>>>>>>>> http://www.rsyslog.com/********professional-services/<http://www.rsyslog.com/******professional-services/>
>>>>>>>>> <http://**www.rsyslog.com/******professional-services/<http://www.rsyslog.com/****professional-services/>
>>>>>>>>> >
>>>>>>>>>
>>>>>>>> <http://**www.rsyslog.com/******professional-services/<http://www.rsyslog.com/****professional-services/>
>>>>>>>> <http://**www.rsyslog.com/****professional-services/<http://www.rsyslog.com/**professional-services/>
>>>>>>>> >
>>>>>>>>
>>>>>>>>>
>>>>>>>>>  
>>>>>>>>> <http://**www.rsyslog.com/****professional-**services/<http://www.rsyslog.com/**professional-**services/>
>>>>>>>> <http:**//www.rsyslog.com/**professional-**services/<http://www.rsyslog.com/professional-**services/>
>>>>>>>> >
>>>>>>>> <http:**//www.rsyslog.com/****professional-services/<http://www.rsyslog.com/**professional-services/>
>>>>>>>> <http://**www.rsyslog.com/professional-**services/<http://www.rsyslog.com/professional-services/>
>>>>>>>> >
>>>>>>>>
>>>>>>>>>
>>>>>>>>>
>>>>>>>>
>>>>>>>>>  What's up with rsyslog? Follow https://twitter.com/rgerhards
>>>>>>>>>
>>>>>>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>>>>>>>> myriad
>>>>>>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if
>>>>>>>> you
>>>>>>>> DON'T LIKE THAT.
>>>>>>>>
>>>>>>>>  ______________________________********_________________
>>>>>>>>
>>>>>>>>  rsyslog mailing list
>>>>>>>>
>>>>>>> http://lists.adiscon.net/********mailman/listinfo/rsyslog<http://lists.adiscon.net/******mailman/listinfo/rsyslog>
>>>>>>> <http**://lists.adiscon.net/******mailman/listinfo/rsyslog<http://lists.adiscon.net/****mailman/listinfo/rsyslog>
>>>>>>> >
>>>>>>> <http:**//lists.adiscon.net/****mailman/**listinfo/rsyslog<http://lists.adiscon.net/**mailman/**listinfo/rsyslog>
>>>>>>> <htt**p://lists.adiscon.net/****mailman/listinfo/rsyslog<http://lists.adiscon.net/**mailman/listinfo/rsyslog>
>>>>>>> >
>>>>>>>
>>>>>>>>
>>>>>>>>  
>>>>>>>> <http:**//lists.adiscon.net/****mailman/**listinfo/rsyslog<http://lists.adiscon.net/**mailman/**listinfo/rsyslog>
>>>>>>> <htt**p://lists.adiscon.net/mailman/****listinfo/rsyslog<http://lists.adiscon.net/mailman/**listinfo/rsyslog>
>>>>>>> >
>>>>>>> <htt**p://lists.adiscon.net/**mailman/**listinfo/rsyslog<http://lists.adiscon.net/mailman/**listinfo/rsyslog>
>>>>>>> <htt**p://lists.adiscon.net/mailman/**listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog>
>>>>>>> >
>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>
>>>>>>>>  
>>>>>>>> http://www.rsyslog.com/********professional-services/<http://www.rsyslog.com/******professional-services/>
>>>>>>>> <http://**www.rsyslog.com/******professional-services/<http://www.rsyslog.com/****professional-services/>
>>>>>>>> >
>>>>>>>>
>>>>>>> <http://**www.rsyslog.com/******professional-services/<http://www.rsyslog.com/****professional-services/>
>>>>>>> <http://**www.rsyslog.com/****professional-services/<http://www.rsyslog.com/**professional-services/>
>>>>>>> >
>>>>>>>
>>>>>>>>
>>>>>>>>  
>>>>>>>> <http://**www.rsyslog.com/****professional-**services/<http://www.rsyslog.com/**professional-**services/>
>>>>>>> <http:**//www.rsyslog.com/**professional-**services/<http://www.rsyslog.com/professional-**services/>
>>>>>>> >
>>>>>>> <http:**//www.rsyslog.com/****professional-services/<http://www.rsyslog.com/**professional-services/>
>>>>>>> <http://**www.rsyslog.com/professional-**services/<http://www.rsyslog.com/professional-services/>
>>>>>>> >
>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>
>>>>>>>>  What's up with rsyslog? Follow https://twitter.com/rgerhards
>>>>>>>>
>>>>>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>>>>>>> myriad
>>>>>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if
>>>>>>> you
>>>>>>> DON'T LIKE THAT.
>>>>>>>
>>>>>>>  ______________________________******_________________
>>>>>>>
>>>>>>>  rsyslog mailing list
>>>>>> http://lists.adiscon.net/******mailman/listinfo/rsyslog<http://lists.adiscon.net/****mailman/listinfo/rsyslog>
>>>>>> <http:**//lists.adiscon.net/**mailman/**listinfo/rsyslog<http://lists.adiscon.net/**mailman/listinfo/rsyslog>
>>>>>> >
>>>>>> <http:**//lists.adiscon.net/**mailman/**listinfo/rsyslog<http://lists.adiscon.net/mailman/**listinfo/rsyslog>
>>>>>> <htt**p://lists.adiscon.net/mailman/**listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog>
>>>>>> >
>>>>>>
>>>>>>>
>>>>>>>  
>>>>>>> http://www.rsyslog.com/******professional-services/<http://www.rsyslog.com/****professional-services/>
>>>>>> <http://**www.rsyslog.com/****professional-services/<http://www.rsyslog.com/**professional-services/>
>>>>>> >
>>>>>> <http://**www.rsyslog.com/**professional-**services/<http://www.rsyslog.com/professional-**services/>
>>>>>> <http:**//www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/>
>>>>>> >
>>>>>>
>>>>>>>
>>>>>>>  What's up with rsyslog? Follow https://twitter.com/rgerhards
>>>>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>>>>>> myriad
>>>>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
>>>>>> DON'T LIKE THAT.
>>>>>>
>>>>>>  ______________________________******_________________
>>>>>>
>>>>>>  rsyslog mailing list
>>>>> http://lists.adiscon.net/******mailman/listinfo/rsyslog<http://lists.adiscon.net/****mailman/listinfo/rsyslog>
>>>>> <http:**//lists.adiscon.net/**mailman/**listinfo/rsyslog<http://lists.adiscon.net/**mailman/listinfo/rsyslog>
>>>>> >
>>>>> <http:**//lists.adiscon.net/**mailman/**listinfo/rsyslog<http://lists.adiscon.net/mailman/**listinfo/rsyslog>
>>>>> <htt**p://lists.adiscon.net/mailman/**listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog>
>>>>> >
>>>>>
>>>>>>
>>>>>>  
>>>>>> http://www.rsyslog.com/******professional-services/<http://www.rsyslog.com/****professional-services/>
>>>>> <http://**www.rsyslog.com/****professional-services/<http://www.rsyslog.com/**professional-services/>
>>>>> >
>>>>> <http://**www.rsyslog.com/**professional-**services/<http://www.rsyslog.com/professional-**services/>
>>>>> <http:**//www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/>
>>>>> >
>>>>>
>>>>>>
>>>>>>  What's up with rsyslog? Follow https://twitter.com/rgerhards
>>>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>>>>> myriad
>>>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
>>>>> DON'T LIKE THAT.
>>>>>
>>>>>  ______________________________****_________________
>>>>>
>>>> rsyslog mailing list
>>>> http://lists.adiscon.net/****mailman/listinfo/rsyslog<http://lists.adiscon.net/**mailman/listinfo/rsyslog>
>>>> <http:**//lists.adiscon.net/mailman/**listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog>
>>>> >
>>>> http://www.rsyslog.com/****professional-services/<http://www.rsyslog.com/**professional-services/>
>>>> <http://**www.rsyslog.com/professional-**services/<http://www.rsyslog.com/professional-services/>
>>>> >
>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
>>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
>>>> DON'T LIKE THAT.
>>>>
>>>>  ______________________________****_________________
>>>>
>>> rsyslog mailing list
>>> http://lists.adiscon.net/****mailman/listinfo/rsyslog<http://lists.adiscon.net/**mailman/listinfo/rsyslog>
>>> <http:**//lists.adiscon.net/mailman/**listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog>
>>> >
>>> http://www.rsyslog.com/****professional-services/<http://www.rsyslog.com/**professional-services/>
>>> <http://**www.rsyslog.com/professional-**services/<http://www.rsyslog.com/professional-services/>
>>> >
>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
>>> DON'T LIKE THAT.
>>>
>>>  ______________________________**_________________
>> rsyslog mailing list
>> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog>
>> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/>
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
>> DON'T LIKE THAT.
>>
>>  ______________________________**_________________
> rsyslog mailing list
> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog>
> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/>
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> DON'T LIKE THAT.
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

Reply via email to