3.22 is downright ancient (around 7 years old)
We would need to see your full rsyslog.conf before we could understand what's
going on.
My guess is that you are receiving logs at a far faster rate than you are able
to deliver logs, so rsyslog is queueing the logs, if you have your queue size
set higher than your system can actually support, you will run out of memory. If
you limit your queue sizes to what will fit in memory, you should grow to fill
your queues and then rsyslog will stop processing new messages until it is able
to deliver them.
David Lang
On Mon, 7 Oct 2013, Jean-Luc Bassereau wrote:
Date: Mon, 7 Oct 2013 15:48:05 +0200
From: Jean-Luc Bassereau <[email protected]>
Reply-To: rsyslog-users <[email protected]>
To: rsyslog-users <[email protected]>
Subject: Re: [rsyslog] Rsyslog to Graylog RAM usage
Sorry for the lack of informations...
I'm running rsyslog-3.22.1-7.el5 on a RHEL5 64Bits system
I'm using imfile module in order to read log files on the web server this
way :
$ModLoad imfile
$InputFileName log_file_location
$InputFileTag servername:
$InputFileStateFile stat-servername.log
#$InputFileSeverity info
#$InputFileFacility user
$InputRunFileMonitor
if $msg contains 'blabla' then @(z9)graylogserver:514
if $msg contains 'blibli' then @(z9)graylogserver:514
I grab RAM usage this way :
grep VmSize /proc/`cat /var/run/rsyslogd.pid`/status |sed 's/[^0-9]*//g'
I'm testing it right now without any condition (if $msg contains....) but a
simple *.* @graylogserver:514 to check if I have the same issue.
Regards
2013/10/7 Radu Gheorghe <[email protected]>
Hello Jean-Luc,
Unfortunately, I have no idea for now - doesn't soudn familiar to me at
all. But maybe somebody will give you some useful hints if you come up with
additional info like:
- rsyslog version
- configuration
- how you're measuring your memory
- your OS, version, architecture
The first thing you may want to try out, if you didn't already, is to
upgrade to a recent (7.x) version. This should rule out the "already fixed
bugs from unsupported versions" kind of situation. Depending on the OS, you
might find an official package on the rsyslog.com website.
Best regards,
Radu
2013/10/7 Jean-Luc Bassereau <[email protected]>
Hello,
I'm using Rsyslog on several hosts in order to send them to a Graylog
server that centralizes all the data.
I have an issue on the most active hosts on which I try to send the web
server's access log through Rsyslog to my Graylog box, on this machine,
RAM
usage of rsyslog process does not stop growing until the system dies...
I've tried to set up disk queues with the same issue.
Any idea ?
Regards.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
