On Thu, Sep 26, 2013 at 4:28 PM, Robert <[email protected]> wrote:
> Well everyone, my apologies for making this thread so messy, I will run
> the test again with 2 main threads. and no actions queues, and give you the
> results. Right now I have 2 main threads and actions queues giving me up to
> 250k with no dropped packets. I changed the spirent to send me 300k fps,
> and rsyslog is not keeping up with it, this is the current config ( I tried
> the startswith, and that worsen the results, I also added the stop filter
> and that made no differnece )
>
This invalidates the former result. Would it be possible to come to a
single configuration where we make *one change at one time*. Otherwise, we
can't get to any results and this just becomes a waste of time.
Sep 26 10:06:32 firewall1.fdfw TESTSYSLOG: %ASA-6-302016: Teardown UDP
> connection 673586559 for outside:195.230.14.154/14655 to dmz2:
> 172.23.254.134/62348 dur
> ation 0:02:08 bytes 1170
>
> when I change it to:
>
> :hostname, startswith, "fire" {action(type="omfile" DirCreateMode="0700"
> FileCreateMode="0644" File="/logs/f_fw" AsyncWriting="on" FlushOnTXEnd="on"
> IOBufferSize="8k" queue.type="FixedArray" queue.dequeuebatchsize="100"
> queue.size="10000") stop}
>
> I am curious if I am understanding starswith correctly?
>
Jup - "startswith" really does what the name says: it checks if the
property starts with the string you specify.
>
> would isequal "firewall" work better according to the log above?
>
don't change that
>
> attached is iostat -xk 10 ( right now Im sending this to an isilon storage
> using nfs)
>
OK, this goes to NFS. My assumptions just were proven wrong. We are talking
to a very slow off-machine destination...
@David: I think we got the culprit?
Rainer
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
