On Thu, Sep 19, 2013 at 5:33 PM, Rainer Gerhards <[email protected]>wrote:
> > On Thu, Sep 19, 2013 at 5:10 PM, Robert <[email protected]> wrote: > >> Thanks David it was pretty messy, here is the uncommented sections >> hopefully it is a little bit easier to decipher., also attached is a debug >> that I was able to get, not sure what it all means.. >> > > I should have added: this page explains the individual counters. I recommend reading it up, so that you get an idea yourself of what the stats log tells you. http://www.rsyslog.com/rsyslog-statistic-counter/ Rainer > It's not a debug log, but a pstats log. It tells us that the system is > running very smoothly, without any queues filling up (see the max queue > sizes at the end of run!). so my conclusion is that imudp doesn't get into > control quickly enough and/or the receive buffers are too small. You could > try to set the recvbufsize. This requires 7.5.3, which also supports -on > modern enough platforms- enhanced APIs to get messages quicker out of the > OS buffers. > > An even more fundamental cure is possibly to run imudp at real time > priority, which also works in older versions. > > Rainer > >> >> # Run this in debugger mode to troubleshoot >> module(load="impstats" interval="600" severity="7") >> # # to actually gather the data: >> syslog.=debug /var/log/rsyslog-stats >> >> # rsyslog v7 configuration file >> #### MODULES #### >> module(load="imuxsock") >> module(load="imklog") >> # Provides UDP syslog reception >> module(load="imudp" >> TimeRequery="10") >> input(type="imudp" port="514") >> #### GLOBAL DIRECTIVES #### >> # Use default timestamp format >> $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat >> # Include all config files in /etc/rsyslog.d/ >> $IncludeConfig /etc/rsyslog.d/*.conf >> # Set Buffer Size - default is 4k >> $OMFileIOBufferSize 1000k >> $OMFileAsyncWriting on >> main_queue(queue.size="200000000" queue.type="FixedArray" >> queue.workerthreads="8" queue.dequeuebatchsize="1000") >> $InputUDPMaxSessions 40000000 >> #### RULES #### >> #switch back to default ruleset >> $Ruleset RSYSLOG DefaultRuleset >> action_queue(queue.size="10000000" queue.type="FixedArray" >> queue.workerthreads="8") >> $ActionQueueWorkerThreads 8 >> $ActionQueueSize 10000000 >> $ActionQueueType FixedArray >> if $hostname contains 'pdc' then /var/log/test/f_ad >> & ~ >> if $hostname contains 'fdfw' then /var/log/test/f_fw >> & ~ >> if $hostname contains 'networks' then /var/log/test/f_networks >> & ~ >> if $hostname contains 'shib' then /var/log/test/f_shib >> & ~ >> if $hostname contains 'mail' then /var/log/test/f_mail >> & ~ >> if $hostname contains 'vm' then /var/log/test/f_vm >> & ~ >> if $hostname contains 'pix' then /var/log/test/f_pix >> & ~ >> if $hostname contains 'rout' then /var/log/test/f_router >> & ~ >> >> >> >> Robert. >> >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> > > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
