I will run a few more tests, what exactly do you look for in the pstats and mpstats to determine consistemcy ? ----- Original Message ----- From: Rainer Gerhards Sent: 09/30/13 11:26 AM To: rsyslog-users Subject: Re: [rsyslog] perfomance tweaking
On Mon, Sep 30, 2013 at 5:19 PM, Robert <[email protected]> wrote: > Oh ok, its a dedicated lab network. This has gotten me to think about how > the server is configured, and the way that I am measuring the connections > coming in. the sysctl looks like this: > > # Kernel sysctl configuration file for Red Hat Linux > # > # For binary values, 0 is disabled, 1 is enabled. See sysctl(8) and > # sysctl.conf(5) for more details. > > # Controls IP packet forwarding > net.ipv4.ip_forward = 0 > > # Controls source route verification > net.ipv4.conf.default.rp_filter = 1 > > # Do not accept source routing > net.ipv4.conf.default.accept_source_route = 0 > > # Controls the System Request debugging functionality of the kernel > kernel.sysrq = 0 > > # Controls whether core dumps will append the PID to the core filename. > # Useful for debugging multi-threaded applications. > kernel.core_uses_pid = 1 > > # Controls the use of TCP syncookies > net.ipv4.tcp_syncookies = 1 > > # Disable netfilte r on bridges. > net.bridge.bridge-nf-call-ip6tables = 0 > net.bridge.bridge-nf-call-iptables = 0 > net.bridge.bridge-nf-call-arptables = 0 > > # Controls the default maxmimum size of a mesage queue > kernel.msgmnb = 65536 > > # Controls the maximum size of a message, in bytes > kernel.msgmax = 65536 > > # Controls the maximum shared segment size, in bytes > kernel.shmmax = 68719476736 > > # Controls the maximum number of shared memory segments, in pages > kernel.shmall = 4294967296 > > # Default Buffer size Robert 8-9-2013 > net.core.rmem_default = 20000000 > #net.core.rmem_default = 2097152 > net.core.wmem_default = 20000000 > net.core.rmem_max = 104857600 > net.core.wmem_max = 104857600 > > #Kernel receiver backlog - Default 300 > #net.core.netdev_max_backlog = 20000 > > the sysconfig/rsyslog : > > # Options for rsyslogd > # Syslogd options are deprecated since rsyslog v3. > # If you want to use them, switch to compatibility mode 2 by "-c 2" > # See rsyslogd(8) for more de tails > #SYSLOGD_OPTIONS="-c 5 -x" > > ^ not sure if I have the modify this to -c 7? > > it's no longer needed/supported. Just remove "-c 5" (also has no effect except a startup error message) > and my init.d is this: > > #!/bin/bash > # > # rsyslog Startup script for rsyslog. > # > # chkconfig: 2345 12 88 > # description: Syslog is the facility by which many daemons use to log \ > # messages to various system log files. It is a good idea to always \ > # run rsyslog. > ### BEGIN INIT INFO > # Provides: $syslog > # Required-Start: $local_fs > # Required-Stop: $local_fs > # Default-Start: 2 3 4 5 > # Default-Stop: 0 1 6 > # Short-Description: Enhanced system logging and kernel message trapping > daemons > # Description: Rsyslog is an enhanced multi-threaded syslogd supporting, > # among others, MySQL, syslog/tcp, RFC 3195, permitted > # sender lists, filtering on any message part, and fine > # grain output format control. > ### END INIT INFO > > # Source function library. > . /etc/init.d/functions > > RETVAL=0 > PIDFILE=/var/run/syslogd.pid > > prog=rsyslog > exec=/sbin/rsyslogd > lockfile=/var/lock/subsys/$prog > > # Source config > if [ -f /etc/sysconfig/$prog ] ; then > . /etc/sysconfig/$prog > fi > > start() { > [ -x $exec ] || exit 5 > > umask 077 > > echo -n $"Starting system logger: " > daemon --pidfile="${PIDFILE}" $exec -i "${PIDFILE}" $SYSLOGD_OPTIONS > RETVAL=$? > echo > [ $RETVAL -eq 0 ] && touch $lockfile > return $RETVAL > > I am wondering if the tcpdump command that I use, is the best indicator of > how many packets are coming in? > ******tcpdump -i eth2.10 -nn | cut -c 1-8 | uniq -c************* > I am curious if the server just cannot handle the traffic that I am > sending it? and that is why we are seeing such a fluctuation in the resulfs? > need to think a bit about this and also hope that David joins the discussion. I think a priority is to get to consistent local results, else further testing is almost impossible. Rainer ____ ___________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. Robert. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
