On 2/23/2018 8:35 AM, Berend De Schouwer via rsyslog wrote:
Hi,
I've recently come across some machines that flooded rsyslog via
/proc/kmsg on Linux. This means that printk_ratelimit doesn't apply to
all kernel messages.
This resulted in >100 GB log in 24 hours, so I added ratelimit to
imklog. I'm attaching a patch. WorksForMe(tm).
Configuration is the same as the other modules, except it's module-wide
since there's only ever one instance:
module(load="imklog" RatelimitBurst="1000" RatelimitInterval="5")
I've found two conditions that ignore the kernel ratelimit settings:
- writing to /dev/kmsg (used for testing)
- oops in some modules (should fix the module, I know...)
Hi,
Would you be willing to submit this as a Pull Request via GitHub?
https://github.com/rsyslog/rsyslog/blob/master/CONTRIBUTING.md
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
