> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of John Feuerstein > Sent: Tuesday, November 09, 2010 7:07 PM > To: rsyslog-users > Subject: Re: [rsyslog] One thread eating up infinite CPU time > (spinlock?) > > > which inputs do you run? Only imrelp? > > I'm running imuxsock and imrelp on the rsyslog server.
OK, this really smells like a problem with imrelp, and probably with librelp. I now also tend to think that the issue is rooted in select(). I'll try to implement epoll() in librelp, but can't promise I make it this week. But... > > The imuxsock doesn't really get any load, it's just for conformance to > have a working /dev/log for vixie-cron and nullmailer etc. > > Here is the whole server config: > > > $ModLoad imuxsock > > > > # Default syslog file format > > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat > > > > # Never filter duplicated messages > > $RepeatedMsgReduction off > > > > # We need these for further analysis > > $EscapeControlCharactersOnReceive off > > > > $FileOwner syslog > > $FileGroup syslog > > > > $FileCreateMode 0640 > > $DirCreateMode 0750 > > > > $Umask 0027 > > > > $PrivDropToUser syslog > > $PrivDropToGroup syslog > > > > # RELP > > $ModLoad imrelp > > $InputRELPServerRun 600 > > > > $MainMsgQueueSize 100000 > > > ... followed by a lot of splitting with dynamic filenames like this: > > > > $template > SplitServiceRsyncLog,"/srv/log/system/%hostname%/%$now%/rsyncd.log" > > > > if $hostname == 'node6' and $syslogfacility == 16 then - > ?SplitServiceRsyncLog > > & ~ > > if $hostname == 'node7' and $syslogfacility == 16 then - > ?SplitServiceRsyncLog > > & ~ > > if $hostname == 'build' and $syslogfacility == 16 then - > ?SplitServiceRsyncLog > > & ~ > > > > The bottom line is that we need to actually see what rsyslog is > doing. If you > > version is not too old, we could use debug on demand (in the link, > Florian > > says he tested it with 6.x, but left out the more interesting fact of > which > > is the minimum version ;)): > > http://www.rsyslog.com/how-to-use-debug-on-demand/ > > I'm using 5.6.0. That version definitely has it. So it would be worth trying out debug on demand, and turn it on when the issue appears. This will definietely give me some useful clues. Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
