> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Philip M. Gollucci > Sent: Friday, February 04, 2011 12:50 AM > To: rsyslog-users > Subject: [rsyslog] Fwd: Re: rsyslog5 core dumps a-plenty > > This message below never made it the list before b/c the attachments > were too large. > > > On 02/03/11 19:38, Philip M. Gollucci wrote: > > On 02/03/11 10:45, Rainer Gerhards wrote: > >> Philip, > >> > >> the config looks relatively simple, that's good (so far I had more > complex > >> configs to work with). Can you tell me a bit about the workload you > process. > >> Just the regular stuff? Do you have the impression that this bug is > triggered > >> by some specific messages? > > > > While I don't think the issues is 5.5.[56]+ specific, Its definitely > > progressively less stable as you get newer versions. I might give > 5.6.3 > > a spin later today after I update the FreeBSD port. > > > > What kind of work load stats do you want ? I can get pretty detailed, > > here's my guess at whats useful: > > > > ~35 machines + networking hardware, 1 central one all use relp to > > communicate except the networking hardware which is using UDP. > > > > The master passes to a perl daemon to insert into a local mysql and > > aggregate real-time. (ommysql was just too tedious to do all the sql > I > > could do in perl). > > > > We essentially log everything both system and app (PCI-level 1) > > > > We're doing between 600-1500 messages/second depending on time of day > > and how many of the rsyslogds happen to be in the 1 minute of > downtime > > before my cron restarts them. > > > > Also attached now is a ktrace -i / kdump -sE > > > > +---------------------------------------------------------------+ > > | table_schema | data_size | index_size | total_size | > > +---------------------------------------------------------------+ > > | logs | 133.23G | 48.58G | 181.82G | > > > > > > Db Sizes by table (in RAM) CL.logs: > > +----------------------------------------------------------------+ > > | table_name | data_size | index_size | total_size | > > +----------------------------------------------------------------+ > > | web_logs_all | 53.17G | -- | 53.17G | > > | mk_logs | 12.14G | 4.07G | 16.22G | > > | web_logs | 6.91G | 4.5G | 11.42G | > > | system_logs | 7.52G | 3.27G | 10.79G | > > | ripsd_logs | 424.49M | 483.16M | 907.65M | > > | windows_logs | 704.87M | 118.94M | 823.81M | > > | daemon_logs | 435.61M | 210.74M | 646.36M | > > | web_error_logs | 357.83M | 187.23M | 545.06M | > > | mail_logs | 236.16M | 66.05M | 302.22M | > > | cron_logs | 137.31M | 112.35M | 249.66M | > > > > > > I'm absolutely sure *some* messages crash it, but thats not whats > > happening here. (I.E. messages generated by the OTRS software have a > > high percentage of doing it).
Could you provide me a set of sample messages so that I can check? If you like, you can mail me privately. I think the root problem is somewhere message-induced and, if so, it would be very useful to see how it could be triggered. I already use a large set of "malformed" messages (including a few gig of truely random data), but none of them trigger the issue :( Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
