As a side note you should temporarily remove logstash from the picture. Ship to rsyslog. If the problem persists, we can much better troubleshoot. If it does not persist, you know you need to talk to the logstash folks.
Rainer Sent from phone, thus brief. Am 21.05.2014 12:25 schrieb "Rainer Gerhards" <[email protected]>: > This sounds like logstash isn't fast enough in some cases and the relp > window fills up. You can try to increase it: > > http://www.rsyslog.com/doc/omrelp.html > > But that won't help if logstash can't keep up in general. > > The original problem went away? > > Rainer > > Sent from phone, thus brief. > Am 21.05.2014 12:18 schrieb "Muhammad Asif" <[email protected]>: > >> Hi Everyone, >> >> We have configured rsyslog 7.6.3 and logstash on Desktop Machine (CPU: >> core >> i3, RAM: 4GB). We have configured statistics on both rsyslog and logstash. >> RELP is being used between both. When we sent 30716 logs in 10 sec from >> LOIC, there is no loss on logstash but rsyslog sends 256 logs chunk to >> logstash and a delay of about 3 sec is noticed between 256 logs chunk. >> Similarly when we sent 68529, again no loss of logs on logstash and same >> delay is noticed. Please find the attached pstats files of Desktop. >> >> We have performed the same activity on a Server machine (CPU: Xeon Quad >> core, RAM 32 GB), no delay is noticed in this case. Everything is fine.On >> server we are using rsyslogd 8.2. Why delay is not being noticed during >> consecutive 256 logs chunk. >> >> Can you elaborate the reason of delay in Desktop case and can we increase >> 256 logs chunk which rsyslog send to logstash. >> >> The server and desktop stats files are attached. >> >> Thanks >> >> >> >> >> On Tue, May 20, 2014 at 7:23 PM, Rainer Gerhards >> <[email protected]>wrote: >> >> > On Tue, May 20, 2014 at 4:10 PM, masoom alam <[email protected]> >> > wrote: >> > >> > > are you asking for this? >> > > >> > > >> > no. When you run impstats, you get statistics records. Without knowing >> your >> > config, I do not know how exactly they look and where they are written >> to, >> > but they contain the statistics data. I though that you quoted these >> lines >> > when you said "n records where received by rsyslog". What I would like >> to >> > see is how many records were pushed to the forwarding action. That way >> we >> > know how many were actually sent to logstash. >> > >> > If the stats are a bit unclear to you, I suggest reading: >> > >> > http://www.rsyslog.com/doc/impstats.html >> > >> > and - at least as important - the links that go out to the page that >> > describe the actual counters. There is a wealth of information in them >> in >> > cases like these. >> > >> > Rainer >> > >> > see attachement >> > > >> > > >> > _______________________________________________ >> > rsyslog mailing list >> > http://lists.adiscon.net/mailman/listinfo/rsyslog >> > http://www.rsyslog.com/professional-services/ >> > What's up with rsyslog? Follow https://twitter.com/rgerhards >> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> > DON'T LIKE THAT. >> > >> >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
