On Fri, 7 Jul 2017, Joe Blow wrote:
Right now there are 4 spots per log line that i have to look in to check,
so I was doing:
if $!dhost1 == '''+biglist+''' or $!dhost2 == '''+biglist+''' or $!shost1
== '''+biglist+''' or $!shost2 == '''+biglist+''' then
/to/the/moon/alice.log
that's ugly (having to look up four different things)
For workers, i was doing stuff like this:
queue.dequeuebatchsize="5000"
queue.workerthreads="32"
This is probably a significant problem, back it down and only increas it if you
find that a thread is maxing out the CPU. Having too many threads can cripple
you (the other big thing is inappropriate dynafilecachesize)
queue.workerthreadminimummessages="10000"
Any suggestions for the best way to spread the load out over workers? I'm
doing like 80k EPS on the box.
"premature optimization is the root of all evil", the first step is to measure
what's going on and look at the full config.
Any one message will be processed in a single thread, multiple threads work on
different messages in parallel.
do you have impstats data?
look at top and enable per-thread reporting ('H') make sure that every queue has
a name, and show us what top looks at while running under load (we just need to
see the rsyslog threads)
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
