I have a 100 servers using rsyslog v7 sending messages to a VIP which has
10 really rsyslog servers. And I use impstats to monitor them.
every node has 300k msgs "enqueued" per 5 minutes. But some node, 10 or so,
may has 10~200k msgs "size" per 5 minutes! If I restart rsyslogd on one
node, it would be fine for several hours, or days maybe. But during the
time, another node may run into such buffering situation...
I found large netstat send-Q at my nodes, but no recv-Q at rsyslog server.
But have no idea to check such queue at LVS server. So, how can I determine
the root cause? Or which configuration should I change to solve this?
My omfwd configure as follow:
action (
type="omfwd"
Target="172.16.26.249"
Port="514"
Protocol="tcp"
RebindInterval="5000000"
ZipLevel="3"
compression.stream.flushOnTXEnd="off"
name="action_webInfoLog-yf-logs-vip.weibo.cn-514_wwwlog"
queue.filename=
"action_webInfoLog-yf-logs.vip.weibo.cn-514_wwwlog"
queue.size="300000"
queue.dequeuebatchsize="1000"
queue.maxdiskspace="20G"
queue.discardseverity="3"
queue.checkpointinterval="10"
queue.type="linkedlist"
queue.workerthreads="1"
queue.timeoutshutdown="10"
queue.timeoutactioncompletion="10"
queue.timeoutenqueue="20"
queue.timeoutworkerthreadshutdown="10"
queue.workerthreadminimummessages="15000"
queue.maxfilesize="500M"
queue.saveonshutdown="on"
)
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
