Hello, I don't know enough about imfile to provide a good explanation of the behavior. It might be a memory leak, but keep in mind that Vmsize is the "virtual memory", not the actual memory that's allocated to the process. That would be the "reserved size" you can see in "top" under "RES". An increased virtual memory size while reading from growing files might be expected.
The best thing to know for sure is to run a test where you generate lots of logs and see if you actually run out of memory. If it turns out to be an actual bug, check whether it reproduces with a recent version 7 from http://rpms.adiscon.com/ The version 3 included in RHEL5 is really old. If you don't want to upgrade, you might have the option of purchasing support<http://www.rsyslog.com/professional-services/enterprise-support/>, although I don't know if it's possible for such an old version. I guess you can always ask the Adiscon guys to get more details. I hope this helps. Best regards, Radu 2013/10/7 Jean-Luc Bassereau <[email protected]> > Sorry for the lack of informations... > > I'm running rsyslog-3.22.1-7.el5 on a RHEL5 64Bits system > > I'm using imfile module in order to read log files on the web server this > way : > > $ModLoad imfile > $InputFileName log_file_location > $InputFileTag servername: > $InputFileStateFile stat-servername.log > #$InputFileSeverity info > #$InputFileFacility user > $InputRunFileMonitor > > > if $msg contains 'blabla' then @(z9)graylogserver:514 > if $msg contains 'blibli' then @(z9)graylogserver:514 > > > > I grab RAM usage this way : > grep VmSize /proc/`cat /var/run/rsyslogd.pid`/status |sed 's/[^0-9]*//g' > > > I'm testing it right now without any condition (if $msg contains....) but a > simple *.* @graylogserver:514 to check if I have the same issue. > > > Regards > > > > 2013/10/7 Radu Gheorghe <[email protected]> > > > Hello Jean-Luc, > > > > Unfortunately, I have no idea for now - doesn't soudn familiar to me at > > all. But maybe somebody will give you some useful hints if you come up > with > > additional info like: > > - rsyslog version > > - configuration > > - how you're measuring your memory > > - your OS, version, architecture > > > > The first thing you may want to try out, if you didn't already, is to > > upgrade to a recent (7.x) version. This should rule out the "already > fixed > > bugs from unsupported versions" kind of situation. Depending on the OS, > you > > might find an official package on the rsyslog.com website. > > > > Best regards, > > Radu > > > > 2013/10/7 Jean-Luc Bassereau <[email protected]> > > > > > Hello, > > > > > > I'm using Rsyslog on several hosts in order to send them to a Graylog > > > server that centralizes all the data. > > > I have an issue on the most active hosts on which I try to send the web > > > server's access log through Rsyslog to my Graylog box, on this machine, > > RAM > > > usage of rsyslog process does not stop growing until the system dies... > > > I've tried to set up disk queues with the same issue. > > > Any idea ? > > > > > > > > > Regards. > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com/professional-services/ > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > myriad > > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > > DON'T LIKE THAT. > > > > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > DON'T LIKE THAT. > > > > > > -- > Cordialement, > Jean-Luc Bassereau > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
