Hi everyone, I am troubleshooting a few problems on my rsyslog server, the first of which is high CPU usage. Top -H is showing 100% CPU usage for the imptcp module, and I can't figure out why. It doesn't start out that way when rsyslog is restarted, but after a few minutes it goes right to the top of the list. Can help direct me as to why the CPU usage is so high for IMPTCP?
Top output showing threads: PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 32670 root 20 0 6161012 204032 2908 R 99.9 1.7 31:57.75 in:imptcp 32673 root 20 0 6161012 204032 2908 R 79.4 1.7 21:43.37 in:imptcp My config is not that complicated, mostly just filtering things to specific logs by tag. I've included the main queue incoming config below, I can post the rest if needed but it's fairly long so I'll defer that unless necessary. I don't seem to have any problems receiving messages, none are being discarded that I'm aware of. Just seems to be high CPU usage. $umask 0000 $FileCreateMode 0644 $DirCreateMode 0755 $RepeatedMsgReduction off $EscapeControlCharactersOnReceive off $MaxMessageSize 64k $RepeatedMsgReduction off $WorkDirectory /var/spool/rsyslog $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat $ActionQueueType LinkedList $ActionQueueWorkerThreads 2 global(workDirectory="/var/spool/rsyslog" preserveFQDN="on" maxMessageSize="64k") # Provides UDP syslog reception # for parameters see http://www.rsyslog.com/doc/imudp.html module(load="imudp"threads="1" timeRequery="8" batchSize="128") # needs to be done just once #input(type="imudp" port="514") # Provides TCP syslog reception # for parameters see http://www.rsyslog.com/doc/imtcp.html module(load="imptcp" threads="1") # needs to be done just once #input(type="imptcp" port="514") module(load="impstats" interval="60" log.syslog="on" resetCounters="on" /* need to turn log stream logging off! */ /* log.file="/var/log/rsyslogd.stats" */ ) main_queue( queue.workerThreadMinimumMessages="5000" queue.discardmark="45000" queue.workerThreads="2" queue.dequeueBatchSize="2048" queue.spoolDirectory="/var/spool/rsyslog" # where to write on disk queue.fileName="rsyslogmainqueue" queue.maxDiskSpace="5g" # it will stop at this much disk space queue.size="50000" # or this many messages queue.saveOnShutdown="on" # save memory queue contents to disk when rsyslog is exiting } Scot Kreienkamp | Senior Systems Engineer | La-Z-Boy Corporate One La-Z-Boy Drive | Monroe, Michigan 48162 | * 734-384-6403 | | * 7349151444 | * scot.kreienk...@la-z-boy.com<mailto:%7BE-mail%7D> www<http://www.la-z-boy.com/>.la-z-boy.com<http://www.la-z-boy.com/> | facebook.<https://www.facebook.com/lazboy>com<https://www.facebook.com/lazboy>/<https://www.facebook.com/lazboy>lazboy<http://facebook.com/lazboy> | twitter.com/lazboy<https://twitter.com/lazboy> | youtube.com/<https://www.youtube.com/user/lazboy>lazboy<https://www.youtube.com/user/lazboy> [cid:lzbVertical_hres.jpg] This message is intended only for the individual or entity to which it is addressed. It may contain privileged, confidential information which is exempt from disclosure under applicable laws. If you are not the intended recipient, you are strictly prohibited from disseminating or distributing this information (other than to the intended recipient) or copying this information. If you have received this communication in error, please notify us immediately by e-mail or by telephone at the above number. Thank you.
_______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
