On 2017-04-08 20:11, Rainer Gerhards wrote:
It is generally a good idea to enable impstats to check where exactly
queues build up (and how large they grow). Based on that information,
we can evaluate if it just is a config issue or indeed a memory leak
(as david said, none is currently known).
I think I've found where the problem is.
We use the same config file for several servers. It reads around 40
logsfiles and sends them to one or two remote destinations, depending on
the logfile.
Now, the server where rsyslogd wass using gigabytes of RAM after
rsyslogd upgrade (I think to 8.26), also used the same config file the
other servers use, however, it only has 6 or so of these logfiles - the
rest of them do not exist.
Example entry for a logfile which may or may not exist on a given
server:
# /var/www/website/core/logs/pagenotfound.log
input(type="imfile" File="/var/www/website/core/logs/pagenotfound.log"
Tag="pagenotfound.log")
if $programname == 'pagenotfound.log' then {
action(type="omfwd" Target="graylog01" Port="9514" Protocol="tcp")
action(type="omfwd" Target="log01" Port="514" Protocol="tcp")
stop
}
So rsyslogd reports this to /var/log/rsyslogd.log in huge quantities,
gigabytes a day (previous versions were not reporting it, with the same
configuration):
Apr 8 11:38:18 work01.sys.timedoctor.com rsyslogd: file
'/var/log/nginx/website.access.log': open error: No such file or
directory [v8.26.0 try http://www.rsyslog.com/e/2040 ]
Apr 8 11:38:18 work01.sys.timedoctor.com rsyslogd: file
'/var/log/nginx/website.access.log': open error: No such file or
directory [v8.26.0 try http://www.rsyslog.com/e/2040 ]
Apr 8 11:38:18 work01.sys.timedoctor.com rsyslogd: file
'/var/log/nginx/website.error.log': open error: No such file or
directory [v8.26.0 try http://www.rsyslog.com/e/2040 ]
Apr 8 11:38:18 work01.sys.timedoctor.com rsyslogd: file
'/var/log/nginx/website.error.log': open error: No such file or
directory [v8.26.0 try http://www.rsyslog.com/e/2040 ]
Apr 8 11:38:18 work01.sys.timedoctor.com rsyslogd: file
'/var/www/website/core/cache/logs/error.log': open error: No such file
or directory [v8.26.0 try http://www.rsyslog.com/e/2040 ]
Apr 8 11:38:18 work01.sys.timedoctor.com rsyslogd: file
'/var/www/website/core/cache/logs/error.log': open error: No such file
or directory [v8.26.0 try http://www.rsyslog.com/e/2040 ]
Apr 8 11:38:18 work01.sys.timedoctor.com rsyslogd: file
'/var/www/website/core/logs/pagenotfound.log': open error: No such file
or directory [v8.26.0 try http://www.rsyslog.com/e/2040 ]
Apr 8 11:38:18 work01.sys.timedoctor.com rsyslogd: file
'/var/www/website/core/logs/pagenotfound.log': open error: No such file
or directory [v8.26.0 try http://www.rsyslog.com/e/2040 ]
At the same time, rsyslogd memory usage grows to gigabytes (previous
versions were not using gigabytes of RAM, if the logfiles did not
exist).
When I removed the nonexisting files from the config file, memory usage
stays more or less the same, about 330 MB.
So, not sure if it's a bug or a feature.
Tomasz Chmielewski
https://lxadm.com
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
