On Tue, 24 Sep 2013, Robert wrote:
So I went ahead and removed the action queues as well as the OMFile from all the rules, and it didnt seem to help. Currently I am emulating traffic at 250k mps and I am dropping alot of messages. I have attached my mpstats, my overall cpu stats, and the rsyslog-stats from the impstats module.
Ok, this shows that you are maxing out your main queue in this configuration
Another question I had was: when I write these Action and OMfile settings in the legacy syntax I think this is right, but what is the right way of doing so with the new syntax?...not sure how to add the queue sizes?************************************** #$ActionQueueWorkerThreads 8 #$ActionQueueSize 10000000 #$ActionQueueType FixedArray #LinkedList - use asynchronous processing $OMFileAsyncWriting on $OMFileFlushOnTXEnd on $OMFileIOBufferSize 1000k :hostname, contains, "fdfw"/logs/f_fw ************************************** #:hostname, contains, "fdfw" action(type="omfile" DirCreateMode="0700" FileCreateMode="0644" File="/logs/f_fw" AsyncWriting="on" FlushOnTXEnd="on" IOBufferSize="1000k")
iobuffersize of 1000K is far too large, 4k or 8k is probably about right.this page shows the various queue parameters in the new format, it's not the right page, but a quick google search isn't showing me the best one
http://www.rsyslog.com/doc/node32.html
**************************************** thanks for the help everyone Robert.
rsyslog-stats
Description: Attachment: rsyslog-stats
_______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
