> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of John Feuerstein > Sent: Tuesday, November 09, 2010 4:47 PM > To: rsyslog-users > Subject: Re: [rsyslog] One thread eating up infinite CPU time > (spinlock?) > > Hi, > > > this could probably have something todo with the select limit. The > question > > is if this is imrelp or not. > > > > While the CPU is busy, can you continue to receive RELP messages? If > so, is > > output written? > > new RELP messages are received, the conditional splitting and the > dynamic filenames work correctly, and yes, new output is written to the > correct files. (At least that's what I can see when testing with custom > messages from different hosts to different facilities, there are so > many > active logfiles on the production server that it could be possible that > something is lost without being noticed) > > > Also, is it possible to enable run rsyslog in debug mode? That would > enable > > me to see where exactly the problem is. I guess it will be > problematic, > > because debug logs quickly get rather large. But it would be useful. > > I'm a bit skeptic at this, because the problem only comes up after some > days of usage. The rsyslog server and some clients are also in > production and produce a lot of traffic. So I guess the debug log would > grow to several GiB already before the problem even arises. > > Perhaps it's better to try to reproduce it first on a test-bed. I'll > look into it, but I will need something like tcpflood.c for RELP with > the ability to pass custom <hostname> <facility> <priority> <message> > (so I can emulate the real traffic and cause all splitting/dynamic > stuff > to occur) :-) > > BTW, thinking more about it... since the problem always occurs after > some days - perhaps it is related to using %$now% within the filename > templates in combination with the $DynaFileCacheSize? > The lsof shows a lot of open FDs ("REG") for "(deleted)" files of > previous days. FD leaking?
ah! this is interesting. How have you set your dynafile cache sizes? Rainer > > > I would also appreciate if you could add a bug to the bug tracker at > > http://bugzilla.adiscon.com as this enables me to keep track of the > issue > > (and others can better find it if they experience the same issue). > > http://bugzilla.adiscon.com/show_bug.cgi?id=208 > > Thanks, > John > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
