first off, try disabling rate limiting entirely
second, are you on a system that has systemd on it? if so you are running things
through journald and it has it's own rate limiting.
David Lang
On Thu, 20 Jun 2019, David Terwilliger via rsyslog wrote:
Date: Thu, 20 Jun 2019 11:35:09 -0400
From: David Terwilliger via rsyslog <[email protected]>
To: [email protected]
Cc: David Terwilliger <[email protected]>
Subject: [rsyslog] Syslog socket appears to be dropping messages
Hi
I'm about to tear my hair out and tried all the varying config parameters I
can find. Maybe if this is simple for you would you mind pointing me in
the right direction?
I have an application which {I believe} is correctly sending ~10,000 msgs
per run to the socket, rsyslog is only picking up a sub-set of these.
Running rsyslog in debug mode, rsyslogd -dn I see messages getting
processed correctly until the following {red} message appears below
It is consistently writing the same number of messages, some que is filling
up but I cant find which one.
I've tried adding the following to no avail, though it looks like this is
the wrong paramater.
Any suggestions?
$SystemLogRateLimitInterval 1
$SystemLogRateLimitBurst 50000
$ActionQueueSize 10000000
#$IMUXSockRateLimitInterval 1
#$IMUXSockRateLimitBurst 1000000
4249.667255376:main Q:Reg/w0 : ../action.c:
actionCommit[action-5-builtin:omfile]: done, iRet 0
4249.667258571:main Q:Reg/w0 : ../action.c: actionCommitAllDirect: action
9, state 1, nbr to commit 0 isTransactional 1
4249.667261493:main Q:Reg/w0 : ../action.c:
actionCommit[action-9-builtin:omfwd]: enter, 217 msgs
4249.667264225:main Q:Reg/w0 : ../action.c:
actionCommit[action-9-builtin:omfwd]: processing...
4249.667266934:main Q:Reg/w0 : ../action.c:
actionTryCommit[action-9-builtin:omfwd] enter
4249.667269864:main Q:Reg/w0 : ../action.c: doTransaction: have
commitTransaction IF, using that, pWrkrInfo 0x55b0004c2040
4249.667272952:main Q:Reg/w0 : ../action.c: entering
actionCallCommitTransaction[action-9-builtin:omfwd], state: itx, nMsgs 217
4249.667276504:main Q:Reg/w0 : omfwd.c: omfwd: doTryResume 10.64.69.56
iRet 0
4249.667279614:main Q:Reg/w0 : omfwd.c: 10.64.69.56:514/udp
4249.669375032:main Q:Reg/w0 : ../action.c:
actionCallCommitTransaction[action-9-builtin:omfwd] state: itx mod
commitTransaction returned 0
4249.669386192:main Q:Reg/w0 : ../action.c: action[action-9-builtin:omfwd]
transitioned to state: rdy
4249.669389293:main Q:Reg/w0 : ../action.c:
actionCommit[action-9-builtin:omfwd]: return actionTryCommit 0
4249.669392109:main Q:Reg/w0 : ../action.c:
actionCommit[action-9-builtin:omfwd]: done, iRet 0
4249.669395263:main Q:Reg/w0 : ruleset.c: processBATCH: batch of 217
elements has been processed
4249.669399574:main Q:Reg/w0 : queue.c: regular consumer finished, iret=0,
szlog 0 sz phys 217
4249.669410674:main Q:Reg/w0 : queue.c: DeleteProcessedBatch: etry 0 state
3
4249.669419476:main Q:Reg/w0 : queue.c: DeleteProcessedBatch: etry 1 state
3
4249.669431573:main Q:Reg/w0 : queue.c: DeleteProcessedBatch: etry 2 state
3
4249.669437631:main Q:Reg/w0 : queue.c: DeleteProcessedBatch: etry 3 state
3
200 similar lines
4249.671611300:main Q:Reg/w0 : queue.c: DeleteProcessedBatch: etry 215
state 3
4249.671615970:main Q:Reg/w0 : queue.c: DeleteProcessedBatch: etry 216
state 3
4249.671621135:main Q:Reg/w0 : queue.c: DeleteProcessedBatch: we deleted
217 objects and enqueued 0 objects
4249.671625439:main Q:Reg/w0 : queue.c: doDeleteBatch: delete batch from
store, new sizes: log 0, phys 0
4249.671629049:main Q:Reg/w0 : main Q: queue.c: dequeued 0 consumable
elements, szlog 0 sz phys 0
4249.671632747:main Q:Reg/w0 : queue.c: regular consumer finished, iret=4,
szlog 0 sz phys 0
4249.671635968:main Q:Reg/w0 : wti.c: main Q:Reg/w0: worker IDLE, waiting
for work.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
