Thanks for the documentation thread, I had not read that doc, but obviosuly all the answers are there. so from what I am seeing and now understanding from the imstats, is that so far I have not seen any discarded messages (which is a good thing) , and what I am curious about is that I constantly get the main q size up to the maximum, does that mean that the server cannot process those messages as quickly as its receiving them?
----- Original Message ----- From: Rainer Gerhards Sent: 10/10/13 11:33 AM To: Robert Subject: Re: [rsyslog] Tr : Re: perfomance tweaking (fwd) On Thu, Oct 10, 2013 at 5:10 PM, Robert < [email protected] > wrote:I have a question I am going through the the stats, and there are some instances where the action processed goes to 500,00 + does that mean that it writes out that many messages in that second? yup, minus a small margin for i/o in progress plus the extra vagueness you enabled by setting it to deltas. But I'd say +/-5% that's the number that goes to that file during the period. also what are the resource-usage numbers? actually, it would save all of us time if you would read the doc links I continously post ;) once again: http://www.rsyslog.com/rsyslog-statistic-counter/ I really have a reason point you to them ;-) Rainer Thu Oct 10 10:43:47 2013: action 1: processed=1400000 failed=0 Thu Oct 10 10:43:47 2013: imudp(*:514): submitted=0 Thu Oct 10 10:43:47 2013: imudp(*:514): submitted=0 Thu Oct 10 10:43:47 2013: resource-usage: utime=127966546 stime=173249662 maxrss=20414472 minflt=5116893 majflt=0 inblock=0 oublock=21631064 nvcsw=4687486 nivcsw=59354 Thu Oct 10 10:43:47 2013: main Q: size=1985593 enqueued=0 full=0 discarded.full=0 http://discarded.nf =0 maxqsize=20000000 Thu Oct 10 10:43:48 2013: imuxsock: submitted=0 ratelimit.discarded=0 ratelimit.numratelimiters=0 Thu Oct 10 10:43:48 2013: action 1: processed=574000 failed=0 Thu Oct 10 10:43:48 2013: imudp(*:514): submitted=0 Thu Oct 10 10:43:48 2013: imudp(*:514): submitted=0 Thu Oct 10 10:43:48 2013: resource-usage: utime=131556000 stime=174801426 maxrss=20414472 minflt=5116893 majflt=0 inblock=0 oublock=22391480 nvcsw=4814080 nivcsw=59376 Thu Oct 10 10:43:48 2013: main Q: size=1410593 enqueued=0 full=0 discarded.full=0 http://discarded.nf =0 maxqsize=20000000 ----- Original Message ----- From: Robert Sent: 10/10/13 09:46 AM To: Rainer Gerhards Subject: Re: [rsyslog] Tr : Re: perfomance tweaking (fwd) These are the results with 1000 for both timeREquery and batchsize, writing out to /dev/null ----- Original Message ----- From: Rainer Gerhards Sent: 10/10/13 08:48 AM To: Robert Subject: Re: [rsyslog] Tr : Re: perfomance tweaking (fwd) umm.. again the ML thread is broken :-( On Thu, Oct 10, 2013 at 2:43 PM, Robert < [email protected] > wrote:From the documentation does that mean that I should lessen my timeRequery and batchSize? to something lower ? A relatively large batch size is a good thing. I would be conservative with timeRequery in a large batch environment. As I wrote in the doc, I'd recommend not to go higer than 10. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
