> which inputs do you run? Only imrelp? I'm running imuxsock and imrelp on the rsyslog server.
The imuxsock doesn't really get any load, it's just for conformance to have a working /dev/log for vixie-cron and nullmailer etc. Here is the whole server config: > $ModLoad imuxsock > > # Default syslog file format > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat > > # Never filter duplicated messages > $RepeatedMsgReduction off > > # We need these for further analysis > $EscapeControlCharactersOnReceive off > > $FileOwner syslog > $FileGroup syslog > > $FileCreateMode 0640 > $DirCreateMode 0750 > > $Umask 0027 > > $PrivDropToUser syslog > $PrivDropToGroup syslog > > # RELP > $ModLoad imrelp > $InputRELPServerRun 600 > > $MainMsgQueueSize 100000 ... followed by a lot of splitting with dynamic filenames like this: > $template SplitServiceRsyncLog,"/srv/log/system/%hostname%/%$now%/rsyncd.log" > > if $hostname == 'node6' and $syslogfacility == 16 then -?SplitServiceRsyncLog > & ~ > if $hostname == 'node7' and $syslogfacility == 16 then -?SplitServiceRsyncLog > & ~ > if $hostname == 'build' and $syslogfacility == 16 then -?SplitServiceRsyncLog > & ~ > The bottom line is that we need to actually see what rsyslog is doing. If you > version is not too old, we could use debug on demand (in the link, Florian > says he tested it with 6.x, but left out the more interesting fact of which > is the minimum version ;)): > http://www.rsyslog.com/how-to-use-debug-on-demand/ I'm using 5.6.0. Thanks, John _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
