On Fri, Sep 27, 2013 at 5:01 PM, Robert <[email protected]> wrote:
> [rcortiz@simon logs]$ ls
> f_ad f_fw f_mail f_networks f_pix f_router f_shib f_vm
> [rcortiz@simon logs]$ sudo grep 09:00:00 * | wc -l
> 226650
>
>
OK, looking at the pstats it is clear that NFS is much slower. We see a
very quick buildup of up to the max capacity (within ~5min). From then on,
imudp looses messages, because whenever the queue is full, imudp's enqueue
operation is blocked until space becomes available. In that scenario,
realtime prio doesn't help, as the main queue is what doesn't drain quickly
enough. So it looses messages in that time frame. Note that a bit down the
queue doesn't even manage to drain quickly enough, so that it throws away
messages itself.
So this is even more complicated in regard to the output being slow. But
let's first see if we can identify and remove some bottleneck. I now ask
for two more tests, one with local files only, one with NFS, done with
otherwise the SAME config.
What we now do is simply add the "stop" statement to the end of each of the
write actions. This should reduce CPU cycles required. In the local case,
this should lead to a less quick queue buildup. In the NFS case ... I
wonder what will happen ;) I need the local test case to prove that the
theory is correct - otherwise we cannot draw any conclusion from the nfs
test. Due to time zone differences, I would appreciate if you could carry
out both tests, one after the other and post the results with TWO emails
(this is mainly to make the ML processor happy in regard to mail sizes).
Please indicate which one is which scenario. Do not change anything else in
your test setup. I have included the config after my sig, but it is
essentially just the addition of that "stop" statement.
I am looking forward to seeing the results.
Rainer
#### MODULES ####
module(load="imuxsock") # needs to be done just once Roberto 8-9-13
module(load="imklog")
module(load="impstats" log.syslog="off" log.file="/local_path/pstats")
# Provides UDP syslog reception
module(load="imudp"
TimeRequery="10"
SchedulingPolicy="fifo"
SchedulingPriority="10") # needs to be done just once Roberto 8-9-13
input(type="imudp" port="514") # Roberto 8-9-13
#### GLOBAL DIRECTIVES ####
# Use imprecise-old-style timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$MainMsgQueueType FixedArray
$MainMsgQueueSize 20000000
$MainMsgQueueWorkerThreads 2
$MainMsgQueueDequeueBatchSize 1000
$InputUDPMaxSessions 40000000
#### RULES ####
:hostname, contains, "fdfw" {
action (type="omfile"
DirCreateMode="0700"
FileCreateMode="0644"
File="/local_path/f_fw"
FlushOnTXEnd="on"
IOBufferSize="8k"
)
stop
}
:hostname, contains, "mail" {
action (type="omfile"
DirCreateMode="0700"
FileCreateMode="0644"
File="/local_path/f_mail"
FlushOnTXEnd="on"
IOBufferSize="8k"
)
stop
}
:hostname, contains, "shib" {
action (type="omfile"
DirCreateMode="0700"
FileCreateMode="0644"
File="/local_path/f_shib"
FlushOnTXEnd="on"
IOBufferSize="8k"
)
stop
}
:hostname, contains, "pdc" {
action (type="omfile"
DirCreateMode="0700"
FileCreateMode="0644"
File="/local_path/f_ad"
FlushOnTXEnd="on"
IOBufferSize="8k"
)
stop
}
:hostname, contains, "networks" {
action (type="omfile"
DirCreateMode="0700"
FileCreateMode="0644"
File="/local_path/f_networks"
FlushOnTXEnd="on"
IOBufferSize="8k"
)
stop
}
:hostname, contains, "rout" {
action (type="omfile"
DirCreateMode="0700"
FileCreateMode="0644"
File="/local_path/f_router"
FlushOnTXEnd="on"
IOBufferSize="8k"
)
stop
}
:hostname, contains, "vm" {
action (type="omfile"
DirCreateMode="0700"
FileCreateMode="0644"
File="/local_path/f_vm"
FlushOnTXEnd="on"
IOBufferSize="8k"
)
stop
}
:hostname, contains, "pix" {
action (type="omfile"
DirCreateMode="0700"
FileCreateMode="0644"
File="/local_path/f_pix"
FlushOnTXEnd="on"
IOBufferSize="8k"
)
stop
}
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
