FWIW, 5.6.3 is no better or worse; however,
5.7.2 seems to be holding its own for all of about 15 minutes. I'm going to watch it closely on the central box before I push that out to all the clients. 5.7.1 does not. On 02/03/11 19:38, Philip M. Gollucci wrote: > On 02/03/11 10:45, Rainer Gerhards wrote: >> Philip, >> >> the config looks relatively simple, that's good (so far I had more complex >> configs to work with). Can you tell me a bit about the workload you process. >> Just the regular stuff? Do you have the impression that this bug is triggered >> by some specific messages? > > While I don't think the issues is 5.5.[56]+ specific, Its definitely > progressively less stable as you get newer versions. I might give 5.6.3 > a spin later today after I update the FreeBSD port. > > What kind of work load stats do you want ? I can get pretty detailed, > here's my guess at whats useful: > > ~35 machines + networking hardware, 1 central one all use relp to > communicate except the networking hardware which is using UDP. > > The master passes to a perl daemon to insert into a local mysql and > aggregate real-time. (ommysql was just too tedious to do all the sql I > could do in perl). > > We essentially log everything both system and app (PCI-level 1) > > We're doing between 600-1500 messages/second depending on time of day > and how many of the rsyslogds happen to be in the 1 minute of downtime > before my cron restarts them. > > Also attached now is a ktrace -i / kdump -sE > > +---------------------------------------------------------------+ > | table_schema | data_size | index_size | total_size | > +---------------------------------------------------------------+ > | logs | 133.23G | 48.58G | 181.82G | > > > Db Sizes by table (in RAM) CL.logs: > +----------------------------------------------------------------+ > | table_name | data_size | index_size | total_size | > +----------------------------------------------------------------+ > | web_logs_all | 53.17G | -- | 53.17G | > | mk_logs | 12.14G | 4.07G | 16.22G | > | web_logs | 6.91G | 4.5G | 11.42G | > | system_logs | 7.52G | 3.27G | 10.79G | > | ripsd_logs | 424.49M | 483.16M | 907.65M | > | windows_logs | 704.87M | 118.94M | 823.81M | > | daemon_logs | 435.61M | 210.74M | 646.36M | > | web_error_logs | 357.83M | 187.23M | 545.06M | > | mail_logs | 236.16M | 66.05M | 302.22M | > | cron_logs | 137.31M | 112.35M | 249.66M | > > > I'm absolutely sure *some* messages crash it, but thats not whats > happening here. (I.E. messages generated by the OTRS software have a > high percentage of doing it). > > One thing I forgot, I sent you the rsyslog.conf from the Central one. > Attached now is the 'client side' version. > -- ------------------------------------------------------------------------ 1024D/DB9B8C1C B90B FBC3 A3A1 C71A 8E70 3F8C 75B8 8FFB DB9B 8C1C Philip M. Gollucci ([email protected]) c: 703.336.9354 VP Apache Infrastructure; Member, Apache Software Foundation Committer, FreeBSD Foundation Consultant, P6M7G8 Inc. Sr. System Admin, Ridecharge Inc. Work like you don't need the money, love like you'll never get hurt, and dance like nobody's watching. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
