On Thu, Sep 19, 2013 at 5:10 PM, Robert <[email protected]> wrote: > Thanks David it was pretty messy, here is the uncommented sections > hopefully it is a little bit easier to decipher., also attached is a debug > that I was able to get, not sure what it all means.. >
It's not a debug log, but a pstats log. It tells us that the system is running very smoothly, without any queues filling up (see the max queue sizes at the end of run!). so my conclusion is that imudp doesn't get into control quickly enough and/or the receive buffers are too small. You could try to set the recvbufsize. This requires 7.5.3, which also supports -on modern enough platforms- enhanced APIs to get messages quicker out of the OS buffers. An even more fundamental cure is possibly to run imudp at real time priority, which also works in older versions. Rainer > > # Run this in debugger mode to troubleshoot > module(load="impstats" interval="600" severity="7") > # # to actually gather the data: > syslog.=debug /var/log/rsyslog-stats > > # rsyslog v7 configuration file > #### MODULES #### > module(load="imuxsock") > module(load="imklog") > # Provides UDP syslog reception > module(load="imudp" > TimeRequery="10") > input(type="imudp" port="514") > #### GLOBAL DIRECTIVES #### > # Use default timestamp format > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat > # Include all config files in /etc/rsyslog.d/ > $IncludeConfig /etc/rsyslog.d/*.conf > # Set Buffer Size - default is 4k > $OMFileIOBufferSize 1000k > $OMFileAsyncWriting on > main_queue(queue.size="200000000" queue.type="FixedArray" > queue.workerthreads="8" queue.dequeuebatchsize="1000") > $InputUDPMaxSessions 40000000 > #### RULES #### > #switch back to default ruleset > $Ruleset RSYSLOG DefaultRuleset > action_queue(queue.size="10000000" queue.type="FixedArray" > queue.workerthreads="8") > $ActionQueueWorkerThreads 8 > $ActionQueueSize 10000000 > $ActionQueueType FixedArray > if $hostname contains 'pdc' then /var/log/test/f_ad > & ~ > if $hostname contains 'fdfw' then /var/log/test/f_fw > & ~ > if $hostname contains 'networks' then /var/log/test/f_networks > & ~ > if $hostname contains 'shib' then /var/log/test/f_shib > & ~ > if $hostname contains 'mail' then /var/log/test/f_mail > & ~ > if $hostname contains 'vm' then /var/log/test/f_vm > & ~ > if $hostname contains 'pix' then /var/log/test/f_pix > & ~ > if $hostname contains 'rout' then /var/log/test/f_router > & ~ > > > > Robert. > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
