I guess that's the proper answer. I remember that there is still a TODO inside the code. Nobody till now asked for it ;) obviously, there could be a solution in batch mode as well.
Rainer Sent from phone, thus brief. Am 20.05.2013 19:33 schrieb "David Lang" <[email protected]>: > I think I know what's happening to you. > > rsyslog is delaying after each time that it dequeues messages, but it's > operating it batch mode so it's dequeueing multiple messages each time > > if you were to set the max batch size to one message, I think you would > get what you are expecting. > > David Lang > > On Mon, 20 May 2013, David Lang wrote: > > Date: Mon, 20 May 2013 04:16:35 -0700 (PDT) >> From: David Lang <[email protected]> >> Reply-To: rsyslog-users <[email protected]> >> To: rsyslog-users <[email protected]> >> Subject: Re: [rsyslog] Rsyslog simple rate limiting - >> QueueDequeueSlowdown >> >> what is happening that's not matching what you are expecting? >> >> the dequeueslowdown is really not intended for what you are looking to >> do. It's not intended to throttle the output to any particular value, just >> impose some delays to keep the system from wreaking itself. >> >> Also, check the sending system. If it's started multiple output threads, >> that throttling would only apply to a single thread. >> >> What I suggest is actually a 4-tier layout >> >> clients -UDP-> relay (buffering) -TCP-> core relay -UDP-> final >> destinations >> >> where there are going to be multiple final destinations. >> >> using TCP (or RELP) for the middle hop gives me durability when crossing >> networks, wan links, etc. TCP based connections can also be throttled at >> the network layer (either by iptables, or network-based QOS prioritizations) >> >> using UDP again for the final hop lets my us multicase MAC (i.e. >> clusterIP) to put the message on the wire once, and have multiple farms >> receive the message. >> >> David Lang >> >> >> On Mon, 20 May 2013, MarQ wrote: >> >> I want to configure rsyslog with output rate limiting. The idea is to >>> configure linux box as syslog relay with large disk buffer and limiting >>> the >>> rate of events sent to the destination syslog from that system: >>> >>> syslog clients --> syslog relay (buffering) --- (rate limiting) -->syslog >>> destination server >>> >>> According to documentation I have configured >>> queue.dequeueslowdown="1000". >>> It states "using a DequeueSlowdown delay of 1,000 microseconds on a UDP >>> send >>> action ensures that no more than 1,000 messages can be sent within a >>> second". >>> >>> Below is my config. I send the syslog messages to device that shows me >>> events per seconds. The value is about 4 thousands events per seconds. I >>> send lots of events to rsyslog server. The idea is to buffer them and >>> send >>> in constant rate to destination server. From my point of view it is not >>> working. Any ideas? >>> >>> *.* action(type="omfwd" protocol="udp" target="x.x.x.x" port="514" >>> rsyslog.WorkDirectory="/tmp" >>> queue.FileName="fwdRule1" >>> queue.size="10000000" >>> queue.MaxDiskSpace="1g" >>> queue.SaveOnShutdown="on" >>> queue.Type="LinkedList" >>> queue.dequeueslowdown="1000" >>> action.resumeRetryCount="-1" >>> #action.RetryCount="-1" >>> ) >>> >>> MarQ >>> >>> >>> >>> -- >>> View this message in context: http://rsyslog-rsyslog-users.** >>> 1305293.n2.nabble.com/Rsyslog-**simple-rate-limiting-** >>> QueueDequeueSlowdown-**tp7580546.html<http://rsyslog-rsyslog-users.1305293.n2.nabble.com/Rsyslog-simple-rate-limiting-QueueDequeueSlowdown-tp7580546.html> >>> Sent from the rsyslog -- rsyslog-users mailing list archive at >>> Nabble.com. >>> ______________________________**_________________ >>> rsyslog mailing list >>> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> >>> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> >>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>> DON'T LIKE THAT. >>> >>> ______________________________**_________________ >> rsyslog mailing list >> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> >> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> >> ______________________________**_________________ > rsyslog mailing list > http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> > http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
