this probably means that rsyslog is not keeping up with the volume of logs
being sent to it (causing them to queue and eat memory)
I'm not seeing anything really unusual in the configuration. you do have
one dynafile template, I'm not really familiar with how much overhead that
causes (I have too many servers to put each in it's own directory, and I
roll the logs rather than writing them to a dynamic location)
it would be interesting to learn what your log rate per second is.
also, if you know when you are hitting peack volume of logs, it would be
interesting to see what the cpu utilization (of each thread) looks like
(using top, turn on the per-thread with 'h' and then see what shows up)
the ulimit you are setting is for the stack, not for the total memory, and
unless you want rsyslog to be killed when it hits the limit, you don't
want to control this via ulimits anyway.
at this point 5.6.3 is a bit old, newer versions are probably faster and
may solve your problem just from being enough faster to keep up with the
incoming logs.
you may also want to run iostat -x and see if you are maxing out your disk
I/O during peak times.
David Lang
On Tue, 12 Jul 2011, Mike Forbes wrote:
Subject: [rsyslog] High memory use by rsyslogd - 5.6.3
Rsyslogd is using 1.4G of resident memory.
Here's my config snippets: http://paste.nothing.net.nz/806cba
There's 14 hosts sending data to this rsyslog server.
I've tried setting a ulimit
(syslog soft stack 1024)
via pam & /etc/security/limits.conf
and ulimit -a as the syslog user shows
stack size (kbytes, -s) 1024
Yet top clearly shows using 1.4G of resident memory:
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
16414 syslog 20 0 2006m 1.4g 1252 S 0 72.1 1:28.83 rsyslogd -c4
my rsyslogd version is rsyslogd 5.6.3
Any advice is welcome.
--
// Mike Forbes
GPG: BFC7 3F32 2CCF D91F 53E1 DF88 1578 B2E4 1399 6844
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
