Hi, After some test it seems that: - $imjournalRatelimitInterval 0 works and rate limiting is disabled - $imjournalRatelimitInterval 30 & $imjournalRatelimitBurst 60000 does not works log are dropped and worst: logs are dropped under default threshold of 20000 (I have ~45000 logs lines dropped for 60000 logs lines received). - module(load="imjournal" ratelimit.interval="30" ratelimit.burst="65000") works logs are not dropped under 65000 logs line
So $imjournalRatelimitInterval & $imjournalRatelimitBurst under legacy syntax are not respected by rsyslog (drop under default threeshold) and new syntax ratelimit.interval="30" ratelimit.burst="65000" works. Is it normal that $imjournalRatelimitInterval & $imjournalRatelimitBurst does not works? If i should use new syntax, in Centos7 imjournal module is loaded in default /etc/rsyslog.conf file ($ModLoad imjournal), how to define parameters with new syntax (ratelimit.interval="30" ratelimit.burst="65000") without edit default configuration file /etc/rsyslog.conf? (I want prevent edit default /etc/rsyslog.conf and used /etc/rsyslog.d/custom_file) => module(load="imjournal" ratelimit.interval="30" ratelimit.burst="65000") does not works because already defined in default configuration Thank you for your help ----- Original Message ----- From: "David Goudet" <[email protected]> To: "rsyslog" <[email protected]> Sent: Monday, September 4, 2017 6:33:17 PM Subject: imjournal does not respect $imjournalRatelimitBurst value? Hello, I have dropped logs due to imjournal module. To prevent this, i am using following configuration: $imjournalRatelimitInterval 30 $imjournalRatelimitBurst 80000 But after some tests with following script, logs are dropped again. import syslog syslog.openlog(facility=syslog.LOG_DAEMON, ident="test-conf-log-rate") for i in range(1,80000): syslog.syslog("yy: " + str(i)) syslog.closelog() print "end" Generated logs are: rsyslogd-2177: imjournal: begin to drop messages due to rate-limiting rsyslogd-2177: imjournal: 65537 messages lost due to rate-limiting I have try to send 60 000 logs, but result is same. rsyslogd-2177: imjournal: begin to drop messages due to rate-limiting rsyslogd-2177: imjournal: 45201 messages lost due to rate-limiting With $imjournalRatelimitInterval 0 (rate limit disabled) there is no log dropped after tests => configuration works as excepted My environment is: Centos 7.3, rsyslog-7.4.7-16.el7.x86_64 Journald configuration is ok and logs are present in journald database. RateLimitInterval=30s RateLimitBurst=160000 I don't understand why rsyslog dropped logs with this configuration. Is there any parameters missing on imjournal configuration to prevent log dropping? Is it known problem? Thank you for your help -- David GOUDET LYRA NETWORK IT Operations service Tel : +33 (0)5 32 09 09 74 | Poste : 574 -- David GOUDET LYRA NETWORK IT Operations service Tel : +33 (0)5 32 09 09 74 | Poste : 574 _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
