what is happening that's not matching what you are expecting?
the dequeueslowdown is really not intended for what you are looking to do. It's
not intended to throttle the output to any particular value, just impose some
delays to keep the system from wreaking itself.
Also, check the sending system. If it's started multiple output threads, that
throttling would only apply to a single thread.
What I suggest is actually a 4-tier layout
clients -UDP-> relay (buffering) -TCP-> core relay -UDP-> final destinations
where there are going to be multiple final destinations.
using TCP (or RELP) for the middle hop gives me durability when crossing
networks, wan links, etc. TCP based connections can also be throttled at the
network layer (either by iptables, or network-based QOS prioritizations)
using UDP again for the final hop lets my us multicase MAC (i.e. clusterIP) to
put the message on the wire once, and have multiple farms receive the message.
David Lang
On Mon, 20 May 2013, MarQ wrote:
I want to configure rsyslog with output rate limiting. The idea is to
configure linux box as syslog relay with large disk buffer and limiting the
rate of events sent to the destination syslog from that system:
syslog clients --> syslog relay (buffering) --- (rate limiting) -->syslog
destination server
According to documentation I have configured queue.dequeueslowdown="1000".
It states "using a DequeueSlowdown delay of 1,000 microseconds on a UDP send
action ensures that no more than 1,000 messages can be sent within a
second".
Below is my config. I send the syslog messages to device that shows me
events per seconds. The value is about 4 thousands events per seconds. I
send lots of events to rsyslog server. The idea is to buffer them and send
in constant rate to destination server. From my point of view it is not
working. Any ideas?
*.* action(type="omfwd" protocol="udp" target="x.x.x.x" port="514"
rsyslog.WorkDirectory="/tmp"
queue.FileName="fwdRule1"
queue.size="10000000"
queue.MaxDiskSpace="1g"
queue.SaveOnShutdown="on"
queue.Type="LinkedList"
queue.dequeueslowdown="1000"
action.resumeRetryCount="-1"
#action.RetryCount="-1"
)
MarQ
--
View this message in context:
http://rsyslog-rsyslog-users.1305293.n2.nabble.com/Rsyslog-simple-rate-limiting-QueueDequeueSlowdown-tp7580546.html
Sent from the rsyslog -- rsyslog-users mailing list archive at Nabble.com.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
