On Mon, Aug 10, 2015 at 2:24 PM, David Lang <[email protected]> wrote: > If you disable the RepeatedMsgReduction function does it eliminate your > problem?
Yes, it does, and between your comments and my general feelings about the option, I have no qualms about just leaving it off. Thanks. Andy > > That function exists for legacy compatibility, but it really only made sense > a couple decades ago when systems were small enough that people were looking > through the logs manually. Nowdays you really want every instance of the > error in the log so that your downstream log analasis tools can detect the > multiple messages. > > David Lang > > On Mon, 10 Aug 2015, Andrew Davidoff wrote: > >> Apologies for not seeing this sooner: I think this is my bug: >> https://github.com/rsyslog/rsyslog/issues/441 >> >> Andy >> >> On Mon, Aug 10, 2015 at 10:46 AM, Andrew Davidoff <[email protected]> >> wrote: >>> >>> Hey All, >>> >>> I'm just starting with rsyslogd (transitioning from syslog-ng) and am >>> working on getting a UDP collector set up. This machine will >>> ultimately need to process ~10k messages/sec, but right now far, far >>> fewer are being sent as I test. >>> >>> The rsyslogd version is 8.11.0-0adiscon2trusty1 pulled from the >>> Adiscon repo running under Ubuntu 14.04 kernel 3.13.0-45-generic >>> running on baremetal. Originally I was running the same version under >>> an Ubuntu 14.04 Xen VM but moved to a baremetal (different machine >>> entirely) just to rule out virtualization with regard to the crashes >>> I'm seeing. >>> >>> I'm finding that if I configure imudp with more than 1 thread, >>> rsyslogd crashes. Upstart restarts it, and it crashes again after some >>> short amount of time, repeat. At this point I have stripped down my >>> config to something only slightly modified from the stock one but the >>> crash persists. >>> >>> apport is catching the crashes and so far I've seen a variety of >>> different types of backtraces, which I'm attaching. I'm also attaching >>> my configuration. I can provide the full apport crash record if >>> necessary. Note that I'm new to apport and am trying to generate >>> backtraces with all the useful debugging symbols, but I think I >>> haven't got this quite right yet. >>> >>> Possibly interesting is that if I run rsyslogd in debug mode, either >>> using the legacy config options or -dn fro the command line, it does >>> not crash. >>> >>> Any thoughts on this? I found similar looking crash reports on the web >>> but they're all pretty old (years old). >>> >>> Apologies if attaching the crash and config information rather than >>> including it inline is poor form, but it's so much text I figured >>> attaching might be more manageable. >>> >>> Thanks. >>> Andy >> >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T >> LIKE THAT. >> > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
