rsyslog uses multiple threads, if you can tell which thread is using all
the CPU and then do a strace of it and dump the sequence of calls that it
makes to process one of the messages it may help
I don't have any idea what's going on here, so I'm just working through
the steps that I would be doing if I was running into the problem
try ps -eLf to list the different threads
in top, hit 'H' to run on per-thread reporting (at which point you may get
some additional info on the right about what the thread is doing)
from the stats you are showing here, it looks like the thread you got with
your strace is the parent that's receiving messages (lots of gettimeofday
and receive/read type calls) the correct one should have write calls in it
(among others)
the versions you are running are new enough that we shouldn't have any
old, solved problems hitting us.
On Tue, 10 May 2011, bxu
wrote:
Hi David,
The rsyslogd version I tried are 5.8.0(stable) and 6.1.7(devel).
I straced rsyslogd when CPU usage is keeping at 100%.
% time seconds usecs/call calls errors syscall
------ ----------- ----------- --------- --------- ----------------
43.47 0.066967 2309 29 read
38.28 0.058979 855 69 epoll_wait
18.17 0.027994 9331 3 select
0.05 0.000081 1 114 gettimeofday
0.03 0.000041 0 178 69 recvfrom
0.00 0.000000 0 3 recvmsg
------ ----------- ----------- --------- --------- ----------------
100.00 0.154062 396 69 total
Best,
Henry
-----Original Message-----
From: [email protected]
[mailto:[email protected]] On Behalf Of [email protected]
Sent: Tuesday, May 10, 2011 12:35 AM
To: rsyslog-users
Subject: Re: [rsyslog] help : CPU high load of rsyslog writing to Oracle
I accidently deleted your reply, so I am replying to my message
4-5 messages/secshould not be any problem at all.
since writing a copy of the sql commands to a file doesn't show anything
strange, the next step will be to try and run it in debug mode to see if it
logs anything strange as you start having problems.
the next step after that will probably be to do a strace of the thread that
is using all the CPU
I don't see where you mention what version of rsyslog you are using.
David Lang
On Mon, 9 May 2011, [email protected] wrote:
Date: Mon, 9 May 2011 10:56:30 -0700 (PDT)
From: [email protected]
Reply-To: rsyslog-users <[email protected]>
To: rsyslog-users <[email protected]>
Subject: Re: [rsyslog] help : CPU high load of rsyslog writing to
Oracle
given that it only happens after a few messages, I would suspect that
there is something odd with the messages.
could you try writing the messages to a file using the Oracle template
and then look and see if there is anything odd about the messages when
it goes nuts?
the other option is to get a debug dump, but unless it happens right
away, that is likely to be a large dump.
David Lang
On Mon, 9 May 2011, bxu wrote:
Date: Mon, 9 May 2011 10:48:50 -0500
From: bxu <[email protected]>
Reply-To: rsyslog-users <[email protected]>
To: [email protected]
Subject: [rsyslog] help : CPU high load of rsyslog writing to Oracle
Hi All,
I have configured rsyslog writing to Oracle.The writing was
successful.But after several messages have been made into Oracle,the
CPU use percentage of rsyslogd goes up to 99%-100%.It is abnormally too
much high.
There's no problem with the cpu usage when writing to files.
Here is my rsyslogd.conf:
#====================================================
#*.* >192.168.45.213,rsyslog
# Use traditional timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
# Provides kernel logging support (previously done by rklogd)
$ModLoad imklog # Provides support for local system logging (e.g. via
logger command) $ModLoad imuxsock
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.* /dev/console
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none /var/log/messages
# The authpriv file has restricted access.
authpriv.* /var/log/secure
# Log all the mail messages in one place.
mail.* -/var/log/maillog
# Log cron stuff
cron.* /var/log/cron
# Everybody gets emergency messages
*.emerg *
# Save news errors of level crit and higher in a special file.
uucp,news.crit /var/log/spooler
# Save boot messages also to boot.log
local7.* /var/log/boot.log
#Load External Listender
$modload imudp
$UDPServerRun 514
#SPA Messages
#*.* /var/log/linksys.log
$template DynaFile,"/var/log/system-%HOSTNAME%.log"
*.* -?DynaFile
################
#### ORACLE ####
################
$ModLoad omoracle
$OmoracleDBUser syslog
$OmoracleDBPassword syslog
$OmoracleDB syslog
$OmoracleBatchSize 1
$OmoracleBatchItemSize 4096
$OmoracleStatementTemplate OmoracleStatement
$template OmoracleStatement,"INSERT INTO TEST(hostname,message)
VALUES(:hostname,:msg)"
$template TestStmt,"%hostname%%msg%"
*.* :omoracle:;TestStmt
#====================================================
Really appreciate anyone's help!
Best
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
--
This message has been scanned for viruses and dangerous content by
MailScanner, and is believed to be clean.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
