Have a look what impstats tells you. I guess some queue is defined very large and fills up.
Rainer 2017-01-12 12:01 GMT+01:00 mostolog--- via rsyslog < [email protected]>: > Hi > > > At this moment, our testing rsyslog is receiving messages from relay > through RELP in RFC3164 format with message in JSON like: > > <PRI>DATE RELAYHOST TAG: {"field":"foo",..."data":"orig > inal_forwarded_message"} > > Once received, mmjsonparse is executed over MSG to check if incoming > messages "comply", before mmnormalize on data (actually doing nothing due > to liblognorm bugs already reported) and setting some other fields. > > After that, omelasticsearch action is executed and messages are indexed. > > We are receiving ~1 million events/hour and rsyslog has 2GB of memory and > process is killed cause out of memory (every other hour). > > What steps could we take to diagnose if that's correct, how to avoid > it...? Any up to date literature? > > > Thanks. Regards > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
