Hello, guys, I have tried to use impstats to find where is the bottleneck.
From the "client" rsyslog, which receiving messages from /dev/log and forwarding to the "server" through TCP. Wed Dec 4 11:21:28 2019: global: origin=dynstats Wed Dec 4 11:21:28 2019: imuxsock: origin=imuxsock submitted=59971 ratelimit.discarded=0 ratelimit.numratelimiters=0 Wed Dec 4 11:21:28 2019: action 0: origin=core.action processed=23725 failed=0 suspended=0 suspended.duration=0 resumed=0 Wed Dec 4 11:21:28 2019: resource-usage: origin=impstats utime=930709 stime=1031351 maxrss=43152 minflt=10846 majflt=0 inblock=0 oublock=552 nvcsw=64983 nivcsw=28 Wed Dec 4 11:21:28 2019: main Q: origin=core.queue size=36757 enqueued=59971 full=0 discarded.full=0 discarded.nf=0 maxqsize=53379 From the "server" rsyslog, which receiving messages from TCP and forwarding it to UNIX Socket.Wed Dec 4 11:20:06 2019: global: origin=dynstats Wed Dec 4 11:20:06 2019: imuxsock: origin=imuxsock submitted=473 ratelimit.discarded=0 ratelimit.numratelimiters=0 Wed Dec 4 11:20:06 2019: action 0: origin=core.action processed=407374 failed=0 suspended=0 suspended.duration=0 resumed=0 Wed Dec 4 11:20:06 2019: action 1: origin=core.action processed=407372 failed=0 suspended=0 suspended.duration=0 resumed=0 Wed Dec 4 11:20:06 2019: imtcp(514): origin=imtcp submitted=480502 Wed Dec 4 11:20:06 2019: resource-usage: origin=impstats utime=5681488 stime=20512340 maxrss=69580 minflt=25910 majflt=0 inblock=0 oublock=118888 nvcsw=870856 nivcsw=291 Wed Dec 4 11:20:06 2019: main Q: origin=core.queue size=70004 enqueued=477462 full=0 discarded.full=0 discarded.nf=0 maxqsize=70054 But, On the "client" side, it lacks the infos about omfwd. I don't know where are the messages, already sent or in the queue? Does "submitted" mean have been sent? On the "server" side, it lacks the infos about omuxsock. From the online doc, "submitted – total number of messages submitted for processing since startup". Thank you At 2019-12-03 18:04:24, "lxy via rsyslog" <[email protected]> wrote: >Hello, guys, >I found some suggetions about performance improvement as below. >https://www.rsyslog.com/doc/v8-stable/examples/high_performance.html > > >But My destination is an unix socket. So what can I do? >I use many rsyslogs which locating in dockers, then use them to forwad to one >rsyslog in another docker on tcp, and then it forward to an unix socket. >Thank you > > > >_______________________________________________ >rsyslog mailing list >http://lists.adiscon.net/mailman/listinfo/rsyslog >http://www.rsyslog.com/professional-services/ >What's up with rsyslog? Follow https://twitter.com/rgerhards >NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of >sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE >THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
