On Wed, 18 Jan 2017, mostolog--- via rsyslog wrote:
This might be not enough yet to diagnose, but here's an spoiler. We have
managed to review configuration and improve memory footprint, but still
growing over time and ends being killed by oom:
module(load="impstats" log.file="/data/stats.log")
syslog.=debug /data/rsyslog-stats
global(
MaxMessageSize="32k"
just a note that that's a rather large message size.
workDirectory="/data"
parser.escapeControlCharactersOnReceive="off"
)
input(
type="imrelp"
ruleset="relp"
)
you are obviously not showing us the full config, because nothing loads the relp
module.
ruleset(
name="relp"
queue.filename="relp"
queue.maxdiskspace="1G"
queue.SaveOnShutdown="on"
queue.type="LinkedList"
) {
action(
type="mmjsonparse"
)
if $parsesuccess == "FAIL" then {
call error #to write error.log
stop
}
action(
type="mmnormalize"
#actually it's doing nothing, cause liblognorm issues.
)
what issues?
set some variables;
if $!app != $!app then {
call unknown #to write unk.log
stop
}
#this line include files with if's to re-set variables
$IncludeConfig /etc/rsyslog.d/apps/conf/3*.conf
we would need to see what these have in them.
call clean
set a few variables;
action(
type="omelasticsearch"
)
}
#include other rulesets to handle other things, like error or unknown
$IncludeConfig /etc/rsyslog.d/apps/conf/4*.conf
we would need to see what these have in them
The pstats provided seem to be from the beginning of the run, we need to see
them for around the time it runs out of memory.
In the timeframe you are providing, maxrss remains constant, so memory use is
not increasing.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
