> -----Original Message----- > From: Brett Delle Grazie [mailto:[email protected]] > Sent: Wednesday, February 23, 2011 11:06 AM > To: Rainer Gerhards > Cc: rsyslog-users > Subject: Re: [rsyslog] Config guidance requested > > Hi Rainer, > > On 23 February 2011 10:01, Rainer Gerhards <[email protected]> > wrote: > > Quite honestly, the best advise - if you have performance problems - > is to > > update to at least version 4. > > Thanks - and I will certainly attempt to do that (to current stable > version) but in the interim, > are there any obvious config issues?
What's your volume and what's the problem? I don't see anything obviously bad. > > e.g. Should I be using LinkedList for the main queue? Particularly on > the loghost? I don't know the default for v3, but any memory based mode should perform almost equally well (with fixedArray being a very tiny bit faster). But the point is that on average v4 is around 3 to 5 *times* faster than v3. Rainer > > > > > Rainer > > > >> -----Original Message----- > >> From: [email protected] [mailto:rsyslog- > >> [email protected]] On Behalf Of Brett Delle Grazie > >> Sent: Wednesday, February 23, 2011 10:53 AM > >> To: [email protected] > >> Subject: [rsyslog] Config guidance requested > >> > >> Hi, > >> > >> I'm using: > >> RHEL 5.6 (x86_64) > >> kernel 2.6.18-238.1.1.el5 > >> rsyslog-3.22.1-3.el5_5.1 > >> > >> I've got a single loghost working in TCP / UDP mode receiving logs > >> from various systems (rsyslog based and normal syslog based). > >> I'm looking for guidance on the configs below - any recommendations > >> for improving performance would be appreciated. > >> > >> Comments are elided for space. > >> > >> The normal config is: > >> > >> $ModLoad imklog > >> $ModLoad imuxsock > >> $ActionForwardDefaultTemplate RSYSLOG_ForwardFormat > >> > >> *.* @@loghost.xxx.xxx > >> > >> *.info;mail.none;authpriv.none;cron.none > >> /var/log/messages > >> authpriv.* > /var/log/secure > >> mail.* > >> -/var/log/maillog;RSYSLOG_TraditionalFileFormat > >> cron.* > /var/log/cron > >> *.emerg * > >> uucp,news.crit > >> /var/log/spooler > >> local7.* > >> /var/log/boot.log > >> > >> > >> The loghost config is: > >> > >> $ModLoad imklog > >> $ModLoad imuxsock > >> $ModLoad imudp > >> $UDPServerRun 514 > >> $ModLoad imtcp > >> $InputTCPServerRun 514 > >> > >> $template TraditionalFormatWithPRI,"%PRI-text%: %timegenerated% > >> %HOSTNAME% %syslogtag%%msg:::drop-last-lf%\n" > >> $template > >> > DailyPerHostLogs,"/var/log/syslog/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/me > >> ssages.log" > >> :fromhost-ip, !isequal, "127.0.0.1" - > >> ?DailyPerHostLogs;TraditionalFormatWithPRI > >> & ~ > >> > >> *.info;mail.none;authpriv.none;cron.none > >> /var/log/messages > >> authpriv.* > /var/log/secure > >> mail.* > >> -/var/log/maillog;RSYSLOG_TraditionalFileFormat > >> cron.* > /var/log/cron > >> *.emerg * > >> uucp,news.crit > >> /var/log/spooler > >> local7.* > >> /var/log/boot.log > >> > > Thanks, > > -- > Best Regards, > > Brett Delle Grazie _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
