On Mon, 30 Sep 2013, Robert wrote:
The way I calculated the bytes was by getting the cacti reading, 590Mb -> ÷
250,000 eps = 310 bytes ÷ 8 sources = 39bytes ? Hopefully I did the math right.
is one 'event' from spirent one log message or on log message from each source?
(the stats you have been providing are not showing that the distribution of
events is even)
I would say 590Mb / 250,000 = 310 bytes per log message (which includes some
packet overhead).
310 bytes per log message seems quite reasonable
When I ramp up the spirent to 250k eps, the tcpdump command shows ~ 232k
this seems to me like you are loosing messages at the network/kernel level
before you even get to rsyslog. is tcpdump clamining that some messages were
dropped by the kernel? or is it thinking that it's got everything?
if you drop the rate to 220,000 events per second, does tcpdump indicate you are
getting them all?
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
