On Wed, Sep 18, 2013 at 1:42 AM, David Lang <[email protected]> wrote: > At this point, it's probably not the input thread then, which thread is > running out of CPU? You mention running top with the H flag, what threads > is using most of the CPU? > > if one of the outputs is not able to keep up, rsyslog will end up loosing > messages >
Usually an excellent way to spot the culprit is also to have a look at rsyslog's internal stats (the usefulness for performance tweaking depends a bit on the config, though...). I highly recommend gathering them. It's done via the impstats module: http://www.rsyslog.com/doc/impstats.html Also, it would be good to see the full rsyslog configuration, not just a snippet. Sorry if you already posted it, but I couldn't get hold of it in the large volume of mail ;) Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
