Hello
On our rsyslog server the in:imrelp thread is almost always at 100%, according
to impstats this happens when we get around 5,8K messages per second.
When this occurs some of the remote serveres will stop/slow down? logging to
the rsyslog server running imrelp. According to impstats there are no queues to
the actions that get messages from imrelp.
Not sure what else to try, increased the windowsize and turn off
tls.compression but doesn't seem to have any effect.
Any help with this would be much appreciated!
See our config below.
System: Ubuntu 14.04(4.4 kernel) VM on KVM(8 cores and 16GB RAM), rsyslog
3.39(ubuntu ppa) and librelp 1.2.18(ubuntu ppa).
# Imrelp on the server
input(
name="relp-consumer"
type="imrelp"
port="20513"
ruleset="to-kafka"
tls="on"
tls.cacert="/etc/ssl/certs/xxx.pem"
tls.mycert="/etc/ssl/certs/xxx.pem"
tls.myprivkey="/etc/ssl/private/xxx.key"
tls.authMode="name"
tls.permittedPeer=["*.xxx"]
tls.compression="off"
keepalive="on"
MaxDatasize="512K"
)
# Omrelp on the client
ruleset(name="relp-producer") {
action(
type="omrelp"
target="xxx"
port="20514"
tls="on"
tls.cacert="/etc/ssl/certs/xxx"
tls.mycert="/etc/ssl/certs/xxx.pem"
tls.myprivkey="/etc/ssl/private/xxx.key"
tls.authmode="name"
tls.permittedpeer=["xxx"]
tls.compression="off"
queue.spooldirectory="/var/spool/rsyslog"
queue.filename="producer"
queue.maxdiskspace="100g"
queue.saveonshutdown="on"
queue.type="linkedlist"
action.resumeretrycount="-1"
queue.dequeueBatchSize="4096"
WindowSize="1024"
)
stop
}
###
Aksel D.
BDO
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
