On Thu, 19 Sep 2013, Rainer Gerhards wrote:
On Thu, Sep 19, 2013 at 6:13 PM, David Lang <[email protected]> wrote:
looking at your stats here
2013-09-19T10:19:41.438048-04:**00 simon rsyslogd-pstats: action 1:
processed=0 failed=0
2013-09-19T10:19:41.438106-04:**00 simon rsyslogd-pstats: imuxsock:
submitted=23 ratelimit.discarded=0 ratelimit.numratelimiters=23
2013-09-19T10:19:41.438114-04:**00 simon rsyslogd-pstats: action 2:
processed=6296260 failed=0
2013-09-19T10:19:41.438141-04:**00 simon rsyslogd-pstats: action 4:
processed=41377511 failed=0
2013-09-19T10:19:41.438145-04:**00 simon rsyslogd-pstats: action 6:
processed=5397818 failed=0
2013-09-19T10:19:41.438146-04:**00 simon rsyslogd-pstats: action 8:
processed=8992658 failed=0
2013-09-19T10:19:41.438148-04:**00 simon rsyslogd-pstats: action 10:
processed=8993105 failed=0
2013-09-19T10:19:41.438149-04:**00 simon rsyslogd-pstats: action 12:
processed=6296701 failed=0
2013-09-19T10:19:41.438151-04:**00 simon rsyslogd-pstats: action 14:
processed=6296445 failed=0
2013-09-19T10:19:41.438155-04:**00 simon rsyslogd-pstats: action 16:
processed=6296440 failed=0
2013-09-19T10:19:41.438157-04:**00 simon rsyslogd-pstats: imudp(*:514):
submitted=89946984
2013-09-19T10:19:41.438158-04:**00 simon rsyslogd-pstats: imudp(*:514):
submitted=0
2013-09-19T10:19:41.438160-04:**00 simon rsyslogd-pstats: action 2 queue:
size=0 enqueued=6296260 full=0 discarded.full=0 discarded.nf=0
maxqsize=152
2013-09-19T10:19:41.438164-04:**00 simon rsyslogd-pstats: main Q: size=89
enqueued=89947026 full=0 discarded.full=0 discarded.nf=0 maxqsize=11365
That's the most important counter for this context. It tells us the main
queue never got anything really queued up (it never had more then 11,365
messages, which is "nothing" in a high performance environment).
These don't look bad to me.
note that you only have an action queue for one of your actions (action2),
all the rest of your actions are being handled by the main thread. I don't
think this is what you intended (unless there really is something special
about your 'pdc' logs)
Given the main queue stats, I'd say that running any file logging process
on a dedicated queue just wastes CPU cycles and does no good.
This is why I came to the conclusion that the only potential bottleneck I
see is how fast imudp can pull out messages from the OS receive buffers. In
my experience, failure here does not even manifest in increased CPU use by
the imudp thread.
I know you said that you don't think it's DNS lookups, but am I correct in
thinking that if it is a problem with DNS lookups you would have the same
symptoms? the imudp thread would not be eating CPU as it's blocked waiting for
the response from the DNS server.
I wonder if there's a way to run more than one imudp thread on the port. the
inbound packets would not be evenly split between them, but if one is stalled,
the other may be able to pull a packet.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
