We have several rsyslog hosts that forward to a logstash server. It runs
great, then after about an hour, data slows down until we get a trickle.
I did not see anything last time I ran impstats, so I'm stuck. Here's my
config (centos7, rsyslog 8.39) Any advice how to debug this?
$DefaultNetstreamDriver gtls
# certificate files
$DefaultNetstreamDriverCAFile /opt/rsyslog/certs/ca.pem
$DefaultNetstreamDriverCertFile /opt/rsyslog/certs/cert.pem
$DefaultNetstreamDriverKeyFile /opt/rsyslog/certs/key.pem
$MaxOpenFiles 1000000
module(load="imtcp" MaxSessions="1048544" StreamDriver.Mode="1"
StreamDriver.AuthMode="anon") # load TCP listener
#module(load="impstats" interval="60" severity="7" resetCounters="on"
log.file="/export/rsyslog/impstats.log" log.syslog="off")
$WorkDirectory /export/rsyslog
$ActionQueueType LinkedList
$ActionQueueFileName mainmsgq
$ActionQueueSaveOnShutdown on
$ActionQueueHighWaterMark 2000000
$ActionQueueLowWaterMark 1800000
#$ActionQueueSize 4000000
$ActionQueueSize 10000
#$ActionQueueDequeueBatchSize 512
$ActionQueueDequeueBatchSize 100
$ActionQueueMaxDiskSpace 3g
#$ActionQueueWorkerThreads 64
$ActionQueueWorkerThreads 1
$ActionQueueWorkerThreadMinimumMessages 512
template(name="json_line" type="list" )
{
constant(value="{")
constant(value="\"time\":\"")
property(name="timegenerated" dateFormat="rfc3339" format="json" )
constant(value="\",\"msg\":\"")
property(name="msg" format="json")
constant(value="\",\"host\":\"")
property(name="hostname" format="json")
constant(value="\",\"svr\":\"")
property(name="syslogseverity-text" format="json")
constant(value="\",\"process\":\"")
property(name="programname" format="json")
constant(value="\",\"tag\":\"")
property(name="syslogtag" format="json")
constant(value="\",\"uuid\":\"")
property(name="uuid" format="json")
constant(value="\",\"rsyshost\":\"")
property(name="$myhostname" format="json")
constant(value="\"}")
}
$InputTCPServerRun 110 # Telo Logs
action(
type="omfwd"
template="json_line"
target="cortana-relay-1.corp.ooma.com"
Port="9092"
protocol="tcp"
)
action(
type="omfwd"
template="json_line"
target="cortana-relay-2.corp.ooma.com"
Port="9092"
protocol="tcp"
action.execOnlyWhenPreviousIsSuspended="on"
)
--
Sent from Postbox
<https://www.postbox-inc.com/?utm_source=email&utm_medium=siglink&utm_campaign=reach>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
