Hello, I currently have an rsyslog server forwarding events via the "omfwd" module to an alternate rsyslog server which is listening using the "imptcp" module. The intent is to use the compression feature, though at present it is disabled for troubleshooting.
These spikes come to the second rsyslog server but shortly there after we can see that the input on the impctp module fluctuation from 10k to 1million over the course of a minute or so. This continues until the primary syslog server start queuing to disk. The second rsyslog server, despite having its own queue, never fills or writes to disk. This suggests that the issue lies in the way the too systems are communicating within the tcp connection settings. Reading the documentation the imtcp module has something called FlowControl on by default. This is not the same for imptcp, though it does have "RateLimit.Interval" on. By default it is set to 0 disabling rate limiting. Is the parameter "RateLimit.Interval" in imptcp the equivlent to "FlowControl" in imtcp? if not is there a way to disable FlowControl in imptcp, or is there something else that could be causing back pressure on the first rsyslog server? Thanks ----- ~Regards Matthew Gaetano -- View this message in context: http://rsyslog-users.1305293.n2.nabble.com/Disabling-IMPTCP-FlowControl-tp7591485.html Sent from the rsyslog-users mailing list archive at Nabble.com. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
