did you look to see what thread is running out of cpu?
David Lang On Thu, 19 Sep 2013, Robert wrote:
Date: Thu, 19 Sep 2013 11:10:45 -0400 From: Robert <[email protected]> Reply-To: rsyslog-users <[email protected]> To: rsyslog-users <[email protected]> Subject: [rsyslog] performance tweaking Thanks David it was pretty messy, here is the uncommented sections hopefully it is a little bit easier to decipher., also attached is a debug that I was able to get, not sure what it all means.. # Run this in debugger mode to troubleshoot module(load="impstats" interval="600" severity="7") # # to actually gather the data: syslog.=debug /var/log/rsyslog-stats # rsyslog v7 configuration file #### MODULES #### module(load="imuxsock") module(load="imklog") # Provides UDP syslog reception module(load="imudp" TimeRequery="10") input(type="imudp" port="514") #### GLOBAL DIRECTIVES #### # Use default timestamp format $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat # Include all config files in /etc/rsyslog.d/ $IncludeConfig /etc/rsyslog.d/*.conf # Set Buffer Size - default is 4k $OMFileIOBufferSize 1000k $OMFileAsyncWriting on main_queue(queue.size="200000000" queue.type="FixedArray" queue.workerthreads="8" queue.dequeuebatchsize="1000") $InputUDPMaxSessions 40000000 #### RULES #### #switch back to default ruleset $Ruleset RSYSLOG DefaultRuleset action_queue(queue.size="10000000" queue.type="FixedArray" queue.workerthreads="8") $ActionQueueWorkerThreads 8 $ActionQueueSize 10000000 $ActionQueueType FixedArray if $hostname contains 'pdc' then /var/log/test/f_ad & ~ if $hostname contains 'fdfw' then /var/log/test/f_fw & ~ if $hostname contains 'networks' then /var/log/test/f_networks & ~ if $hostname contains 'shib' then /var/log/test/f_shib & ~ if $hostname contains 'mail' then /var/log/test/f_mail & ~ if $hostname contains 'vm' then /var/log/test/f_vm & ~ if $hostname contains 'pix' then /var/log/test/f_pix & ~ if $hostname contains 'rout' then /var/log/test/f_router & ~ Robert.
_______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
