Hello, BTW, I tried your suggestion to create several IMRELP servers.
In the rsyslog.conf I've that. I've created 16 IMRELP servers: # to listen for incoming RELP remote syslog connections module(load="imrelp") # needs to be done just once input(type="imrelp" port="20500") input(type="imrelp" port="20501") input(type="imrelp" port="20502") input(type="imrelp" port="20503") input(type="imrelp" port="20504") input(type="imrelp" port="20505") input(type="imrelp" port="20506") input(type="imrelp" port="20507") input(type="imrelp" port="20508") input(type="imrelp" port="20509") input(type="imrelp" port="20510") input(type="imrelp" port="20511") input(type="imrelp" port="20512") input(type="imrelp" port="20513") input(type="imrelp" port="20514") input(type="imrelp" port="20515") But I still have the issue. Some of them disappear immediately after restarting rsyslogd, Doing a netstat -ann | grep 205, here are the IMRELP servers listening on their sockets and running fine: tcp 0 0 0.0.0.0:20503 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:20504 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:20507 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:20509 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:20510 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:20511 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:20512 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:20513 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:20514 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:20515 0.0.0.0:* LISTEN As you can see, servers on ports 20500, 20501, 20502, 20505, 20506, 20508 disappeared. The others are running fine and process logs. I've to add that the IMRELP servers that disappear can be random... KR. Nicolas - United Nations International Computing Center Geneva rmkml <[email protected]> a écrit : > ah ok (I reread your reply), sorry. > > maybe can you try copy old binary on RHEL5 to new RHEL6.4 plateform? > > file+ldd on old rsyslog binary > file+ldd on "new" rsyslog binary > > Regards > Rmkml > > > On Mon, 11 Mar 2013, rmkml wrote: > >> Hi Nicolas, >> >> but can you try workaround by spliting syslog srv src to few >> differents dst ports please? >> >> srv.src.syslog.1 send to syslog port 20515 >> >> srv.src.syslog.2 send to syslog port 20516 >> >> srv.src.syslog.3 send to syslog port 20517 >> >> srv.src.syslog.4 send to syslog port 20518 >> ... >> >> Regards >> Rmkml >> >> >> >> On Mon, 11 Mar 2013, Nicolas HAHN wrote: >> >>> >>> Hello, >>> >>> Well, I don't think this is a rate limit for following reasons: >>> - The old server we will replace with this new one, is based on >>> RHEL 5. It currently supports the same load (for rsyslog) than the >>> new one on which we have the issues. FYI the load are tons of real >>> time >>> messaging server logs, coming from tens of linux postfix and >>> microsoft exchange servers. >>> - We did on the new server this test: we have sent only a few logs >>> from a remote syslog "sender", and we also had the same issues. >>> >>> One thing I forgot to mention in my first e-mail is that all the >>> traffic is sent by the rsyslog server to a PostgreSQL 9.2.3 >>> database (running of course on the same server). >>> >>> This afternoon, I downloaded the latest SOURCE vesion of rsyslog: 7.2.6-2 >>> >>> I did the compilation myself, including RELP and PGSQL modules. >>> >>> I did some testing again with this freshly compiled version, and >>> again I've exactly the same issues... >>> >>> I don't know what to do now... :-( >>> >>> Thanks for your reply any way :-) >>> >>> KR. >>> Nicolas >>> - >>> United Nations International Computing Center >>> Geneva >>> >>> >>> Rm Kml <[email protected]> a écrit : >>> >>>> Hi Nicolas, >>>> Maybe you have found a bug or rate limit on imrelp... >>>> Why cannot split few syslog src to few new relp ports like 20515 20516 >>>> 20517...? (each différent ports on each différent cpu...) >>>> Maybe add rate limit on syslog src srv ? >>>> Regards >>>> Rmkml >>>> >>>> >>> >>> >>> ---------------------------------------------------------------- >>> This message was sent using IMP, the Internet Messaging Program. >>> >>> >> ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
