Hi
At this moment, our testing rsyslog is receiving messages from relay
through RELP in RFC3164 format with message in JSON like:
<PRI>DATE RELAYHOST TAG:
{"field":"foo",..."data":"original_forwarded_message"}
Once received, mmjsonparse is executed over MSG to check if incoming
messages "comply", before mmnormalize on data (actually doing nothing
due to liblognorm bugs already reported) and setting some other fields.
After that, omelasticsearch action is executed and messages are indexed.
We are receiving ~1 million events/hour and rsyslog has 2GB of memory
and process is killed cause out of memory (every other hour).
What steps could we take to diagnose if that's correct, how to avoid
it...? Any up to date literature?
Thanks. Regards
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
