Things look so much better. I don't see the receive buffer errors incrementing and my receive queue is empty.
-----Original Message----- From: rsyslog <[email protected]> On Behalf Of Singh, Radesh via rsyslog Sent: Friday, August 02, 2019 9:03 PM To: David Lang <[email protected]> Cc: Singh, Radesh <[email protected]>; Singh, Radesh via rsyslog <[email protected]> Subject: Re: [rsyslog] [E]Re: Missing messages Do you think other tuning would be advisable at this point? I'm gonna get my firewall guy to check and see if he's still missing messages. Radesh -----Original Message----- From: David Lang <[email protected]> Sent: Friday, August 02, 2019 9:00 PM To: Singh, Radesh <[email protected]> Cc: David Lang <[email protected]>; Singh, Radesh via rsyslog <[email protected]> Subject: RE: [E]Re: [rsyslog] Missing messages On Sat, 3 Aug 2019, Singh, Radesh wrote: > 2019-08-02T20:39:11.898986-04:00 lnx21648 rsyslogd-pstats: global: > origin=dynstats > 2019-08-02T20:39:11.898991-04:00 lnx21648 rsyslogd-pstats: imuxsock: > origin=imuxsock submitted=0 ratelimit.discarded=0 > ratelimit.numratelimiters=0 > 2019-08-02T20:39:11.898993-04:00 lnx21648 rsyslogd-pstats: action 0: > origin=core.action processed=0 failed=0 suspended=0 > suspended.duration=0 resumed=0 > 2019-08-02T20:39:11.898994-04:00 lnx21648 rsyslogd-pstats: action 1: > origin=core.action processed=3866463 failed=0 suspended=0 > suspended.duration=0 resumed=0 > 2019-08-02T20:39:11.898995-04:00 lnx21648 rsyslogd-pstats: action 2: > origin=core.action processed=3866463 failed=0 suspended=0 > suspended.duration=0 resumed=0 > 2019-08-02T20:39:11.898997-04:00 lnx21648 rsyslogd-pstats: dynafile > cache RemoteClient: origin=omfile requests=5811219 level0=3191120 > missed=56 evicted=0 maxused=56 closetimeouts=0 ok, this shows that you only needed 56, not 1000, but this takes very little memory, so leave it good and high (to understand this, try setting it to 55 or 50 and see how it's going to be almost as bad as when you had it set to 10) > 2019-08-02T20:39:11.899000-04:00 lnx21648 rsyslogd-pstats: action 3: > origin=core.action processed=5811344 failed=0 suspended=0 > suspended.duration=0 resumed=0 I think this is your remote send, it looks like the increase in the wmem has kept that from being the bottleneck (and 128M is not a significant amount of memory on your system) Linux was developed on a 386 with 4M of ram, it tends to have very stingy buffer sizing (it's been enlarged over the years, but it's still stingy), so it's a good idea to check these sorts of things when you are dedicating a box to a single purpose and driving it hard. These generally won't matter if you are using it as a general desktop. > 2019-08-02T20:39:11.899007-04:00 lnx21648 rsyslogd-pstats: dynafile > cache RemoteClient: origin=omfile requests=0 level0=0 missed=0 > evicted=0 maxused=0 closetimeouts=0 > 2019-08-02T20:39:11.899008-04:00 lnx21648 rsyslogd-pstats: action 4: > origin=core.action processed=0 failed=0 suspended=0 > suspended.duration=0 resumed=0 > 2019-08-02T20:39:11.899010-04:00 lnx21648 rsyslogd-pstats: action 5: > origin=core.action processed=9 failed=0 suspended=0 > suspended.duration=0 resumed=0 > 2019-08-02T20:39:11.899010-04:00 lnx21648 rsyslogd-pstats: action 6: > origin=core.action processed=2 failed=0 suspended=0 > suspended.duration=0 resumed=0 > 2019-08-02T20:39:11.899012-04:00 lnx21648 rsyslogd-pstats: action 7: > origin=core.action processed=0 failed=0 suspended=0 > suspended.duration=0 resumed=0 > 2019-08-02T20:39:11.899014-04:00 lnx21648 rsyslogd-pstats: action 8: > origin=core.action processed=0 failed=0 suspended=0 > suspended.duration=0 resumed=0 > 2019-08-02T20:39:11.899015-04:00 lnx21648 rsyslogd-pstats: action 9: > origin=core.action processed=0 failed=0 suspended=0 > suspended.duration=0 resumed=0 > 2019-08-02T20:39:11.899016-04:00 lnx21648 rsyslogd-pstats: action 10: > origin=core.action processed=0 failed=0 suspended=0 > suspended.duration=0 resumed=0 > 2019-08-02T20:39:11.899017-04:00 lnx21648 rsyslogd-pstats: action 11: > origin=core.action processed=0 failed=0 suspended=0 > suspended.duration=0 resumed=0 > 2019-08-02T20:39:11.899018-04:00 lnx21648 rsyslogd-pstats: action 12: > origin=core.action processed=0 failed=0 suspended=0 > suspended.duration=0 resumed=0 > 2019-08-02T20:39:11.899019-04:00 lnx21648 rsyslogd-pstats: action 13: > origin=core.action processed=9 failed=0 suspended=0 > suspended.duration=0 resumed=0 > 2019-08-02T20:39:11.899022-04:00 lnx21648 rsyslogd-pstats: action 14: > origin=core.action processed=2 failed=0 suspended=0 > suspended.duration=0 resumed=0 > 2019-08-02T20:39:11.899023-04:00 lnx21648 rsyslogd-pstats: action 15: > origin=core.action processed=0 failed=0 suspended=0 > suspended.duration=0 resumed=0 > 2019-08-02T20:39:11.899024-04:00 lnx21648 rsyslogd-pstats: action 16: > origin=core.action processed=0 failed=0 suspended=0 > suspended.duration=0 resumed=0 > 2019-08-02T20:39:11.899026-04:00 lnx21648 rsyslogd-pstats: > resource-usage: origin=impstats utime=44426249 stime=61434223 > maxrss=11848 minflt=82853 majflt=0 inblock=0 oublock=2184784 > nvcsw=4479353 nivcsw=8404 > 2019-08-02T20:39:11.899028-04:00 lnx21648 rsyslogd-pstats: > RSYSLOG_DefaultRuleset: origin=core.queue size=0 enqueued=0 full=0 > discarded.full=0 discarded.nf=0 maxqsize=0 > 2019-08-02T20:39:11.899030-04:00 lnx21648 rsyslogd-pstats: main Q: > origin=core.queue size=171 enqueued=5811386 full=0 discarded.full=0 > discarded.nf=0 maxqsize=3412 > 2019-08-02T20:39:11.899032-04:00 lnx21648 rsyslogd-pstats: imudp(w0): > origin=imudp called.recvmmsg=7799005 called.recvmsg=0 > msgs.received=5811352 > > -----Original Message----- > From: David Lang <[email protected]> > Sent: Friday, August 02, 2019 8:47 PM > To: Singh, Radesh <[email protected]> > Cc: David Lang <[email protected]>; Singh, Radesh via rsyslog > <[email protected]> > Subject: RE: [E]Re: [rsyslog] Missing messages > > $DirGroup secopsr > $FileGroup secopsr > $umask 0000 > $DirCreateMode 0754 > $FileCreateMode 0644 > $template RemoteClient,"/var/remote/logs/%HOSTNAME%/%HOSTNAME%-%$NOW%.log" > $DynaFileCacheSize 1000 > :inputname , isequal , "imudp" ?RemoteClient $DynaFileCacheSize 1000 > :inputname , isequal , "imtcp" ?RemoteClient :fromhost-ip , !isequal , > "127.0.0.1" stop > > you lucked out tht the udp output was first, and since you aren't getting > anything via TCP, the question of if it is set there or not doesn't matter. > > what does the stats output show? > > David Lang > _______________________________________________ rsyslog mailing list http://secure-web.cisco.com/1IWqxqQiJktTL_0N8sPOpHFWX2PDh_Qvf3e24rTiXPtuzfty46wNRUz0y9BhESXtzRIHMZT4RRd1BT_s7s2Y7AMWyGBVkVoO0X95eGYrTnV3PPNoHdhTDI_cOilyILBL9_FSOY3vW9VIllbLr7CTU1oYHkG8MSb4P1E5ibEgk_bh6uVcWP7Y7b6wwn4gF-p-69RtsdSqQI63Rr84zmcPeTY1OMs1IYW4MKvwCrtwz7Jh_gIC6V44ycU8Iq_yDRivx_DCPG7qzpDydCTRJYdXymv7teNNER1DHdstw0ZECrquLOlZXqOnnXIKBOhdEV82lOYQImF7fLEUWEVFrrDvmx3uTfhiwAwliedKSJR0Zl_5Cz2HzYZTlzcW33Eq1bxbN/http%3A%2F%2Flists.adiscon.net%2Fmailman%2Flistinfo%2Frsyslog http://secure-web.cisco.com/1E0tQdwoPB_HX_SH3qc4EShe_sKAZ29WLEZCgztv5H85TXdD331u_gsx49u21Pemk7FtNWqd_Kxc3DEDa2ZUT99XlimEeJkj_5USWljuJyiysfV2hV6odHnyDEGw4CVOozxG5eU7UBW2L0tOY_z1V9CuoKWYERwkr659gqGMYDB8h4UEk7m-8mhLETVl8mSv3fJvXn7cm-HO2PFElufuLB1fGaItklUCyRt-k8ibwLDDzQS73T1Tz6Ca3kjKI05fLc87ZSdm-uJAl8ZzthPxGKpa837thmgplOqi8SwKsz0KDIhmhoCKZV-kjscCBocu8lWiGhLs35JAcG6EFtIEzRaDX5OcRg0LnYH1ekYmQzOKve9OGn0JRjDuPeC9RAgeg36w-bnMBcT5FLIFwK1yG3Q/http%3A%2F%2Fwww.rsyslog.com%2Fprofessional-services%2F What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
