> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of John Feuerstein > Sent: Tuesday, November 09, 2010 6:54 PM > To: rsyslog-users > Subject: Re: [rsyslog] One thread eating up infinite CPU time > (spinlock?) > > >> $DynaFileCacheSize 500 > > > > Keep in mind that this setting is ona per-action (!) level. So if you > have 20 > > actions, you have a total limit of 500*20 = 10,000 files that can be > open at > > any time (but not more than 500 for a single action). > > > > This is action-specific so that you can tune the size of the cache to > what is > > expected for the action. > > Wow, this is a very important detail. Can you add this to the > documentation[1]? The scoping doc[2] is also very interesting in this > regard. A document with an overview of parameters with a specific scope > would be very helpful for version 5.x. > > So if I understand this correctly, I was mistaken that rsyslogd should > have closed all rotated files. Instead, it keeps them open until the > DynaFileCache is full... which was wrongly configured by me as you > pointed out (set way too high before all actions in the global scope). > > Is it correct with versions 5.x (no scoping) to do the following, as an > example: > > > $template > SplitServiceRsyncLog,"/srv/log/system/%hostname%/%$now%/rsyncd.log" > > > > $DynaFileCacheSize 1 > > > > if $hostname == 'node6' and $syslogfacility == 16 then - > ?SplitServiceRsyncLog > > & ~ > > if $hostname == 'node7' and $syslogfacility == 16 then - > ?SplitServiceRsyncLog > > & ~ > > if $hostname == 'build' and $syslogfacility == 16 then - > ?SplitServiceRsyncLog > > & ~ > > ... because I expect only one logfile per host per day which should be > held open? > > > And in contrast, for the following selector with two actions: > > > $template SystemAuthLog,"/srv/log/system/CLUSTER/%$now%/auth.log" > > $template > SplitSystemAuthLog,"/srv/log/system/%hostname%/%$now%/auth.log" > > > > $DynaFileCacheSize 30 > > > > auth,authpriv.* ?SystemAuthLog > > & ?SplitSystemAuthLog > > I would set it to 30 because I expect 30 open logfiles per action (one > per host per day)?
In short words: you are right. > > A documented example would be very helpful for this. > I agree, unfortunately, it's a constant struggle. Basically, I am a one-man show except when someone purchases some services. If you look just at the mailing list, it's quite a bit to do. And that's only part of what is on the agenda... Doc usually falls behind :( If someone is up to writing the samples etc. I promise he or she will get edit access to the web site within one working day ;) Rainer > Thanks, > John > > [1] http://www.rsyslog.com/doc/rsconf1_dynafilecachesize.html > [2] http://www.rsyslog.com/doc/scoping.html > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
