start by enabling impstats, that's needed to see what's happening and where the
bottlenexks are.
omudpspoof is slow becuse it needs to make lots of system calls, there's no
direct way to measure this cost, but if you have it as an output with it's own
action queue, you can see the performance of the resulting thread (hit 'H' in
top to per-thread stats)
omudpspoof was a hack I put together to solve the problem. I'ts gotten some
cleanup since I submitted it, but it could be improved significantly by getting
a cache similar to hat dynafiles uses, but it's still going to be significantly
slower than normal output. Someone would need to sponsor such work or contribute
it as this is a low-priority enhancement for the core team.
It can probably use additional metrics as well.
David Lang
On Mon, 28 Oct 2019, Petr Vyhnal via rsyslog wrote:
Date: Mon, 28 Oct 2019 23:36:32 +0100
From: Petr Vyhnal via rsyslog <[email protected]>
To: rsyslog-users <[email protected]>
Cc: Petr Vyhnal <[email protected]>
Subject: [rsyslog] omudpspoof - any metrics to monitor?
Hello all,
I know using omudpspoof plugin is not a good idea at all, but it's only
applicable to my use case. I understood there is some penalty in performance
because of socket operations in background. Is there any way to monitor that?
Any kind of metrics I can read and understand what is server suffering of?
When I use omfwd CPU utilization is high, but all events are forwarded almost
instantly. But rsyslog starts caching when omudpspoof comes into play. So
apparently rsyslog mainQ is aware of omudpspoof performance and it tries to
slow down the flow as much as it can. While this can work for peaks, it can't
work as long term solution. So far I tried different ways (incl iostats, sar,
netstat, ...) to isolate some metric which can tell me when udpspoof plugin
meets its limits, but without success. Any ideas are more than welcome!
Regards,
Petr
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
