Hi David, I am using Rsyslog v. 8.1911.0 (aka 2019.11). I was getting logs from a device which I had configured to forward log messages that the target machine actively refused the connection. This is what I get from *impstats* which made me concern and realized that *imptcp* could not establish all the connections and for some reason it was refusing more than a dozen. The *impstats* msg below:
Sat Jan 4 12:10:38 2020: imptcp(10.20.5.9/514/IPv4): origin=imptcp submitted=583420 sessions.opened=602 sessions.openfailed=49 sessions.closed=0 bytes.received=406186964 bytes.decompressed=0 There are always sessions.openfailed > 0 with imptcp, and from the logs I see that the connection has been refused for some reason... but I cannot figure it out why... However, if I change the module to *imtcp* this is issue goes away but the performance is worst as some cool features exist only on imptcp (which is specifically for better performance on linux). Therefore I cannot serve as many connections as I would like to with imptcp... Do you have any ideas how this problem can be resolved or what might be the cause of this behavior from imptcp? Let me know if you need more information to better understand the situation. Thank you very much in advance, Kyparisis G. rsyslog-users mailing list wrote > can you provide more information about what exactly is happening? (and > what > version of rsyslog you are running). I'm not understanding your problem > > David Lang > > On Fri, 3 Jan 2020, kyparisisg via rsyslog wrote: > >> Date: Fri, 3 Jan 2020 18:15:24 -0700 (MST) >> From: kyparisisg via rsyslog < > [email protected] > > >> To: > [email protected] >> Cc: kyparisisg < > johnkyparisis@ > > >> Subject: [rsyslog] imptcp fails to open all income sessions >> >> Hello guys, >> >> I have been trying to make a proper configuration for my system and I am >> a >> maniac with my testing procedures. >> Long story short after a lot of troubleshoot I realized that imptcp is >> not >> consistent... >> Through impstats I figured out that there are many as appeared: >> *sessions.openfailed= > <more than 10> > * >> Although if I swap to *imtcp* and use the parameter *MaxSessions* I can >> avoid that issue. But unfortunately as Rainer clearly states at the >> documentation, imptcp has better performance and I do not want to give >> that >> up and also there is no option to increase the threads with imtcp.... >> Any suggestions to find a way to keep *imptcp* and resolve this issue. >> >> Thank you very much in advance! >> >> >> >> -- >> Sent from: http://rsyslog-users.1305293.n2.nabble.com/ >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. -- Sent from: http://rsyslog-users.1305293.n2.nabble.com/ _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
