I'm having an odd issue on some 5.8.11 and 4.6.4 rsyslog servers when using imrelp. Here's the relevant config snippet:
$ModLoad imrelp $InputrelpMaxSessions 5000 $InputRELPServerRun 20514 *.* ?hostsbydirectory;standardwithpri & ~ Essentially what happens is that on the restart of the rsyslog service it will accept a few lines worth of logs from some clients and then stop, while pegging a core at 100% cpu utilization. In this state it still accepts regular UDP and TCP syslog just fine. The odd part is that I have identically configured and versioned servers where I triple checked rsyslog config, sysctl parameters, etc, yet the imrelp bits work just fine there. When running in debug mode, the only suspicious thing that I was able to see is that after the relp session starts, a few seconds later this happens: 1545.993749574:7f862941c700: tcpSend returns 105 1545.993757082:7f862941c700: in destructor: sendbuf 0x1fb93a0 1545.993767020:7f862941c700: relp engine is dispatching frame with command 'open' 1545.993774075:7f862941c700: in open command handler 1545.993783213:7f862941c700: processing client offer 'commands' 1545.993790284:7f862941c700: cmd syslog state in srv session: 4 1545.993798094:7f862941c700: processing client offer 'relp_software' 1545.993805150:7f862941c700: processing client offer 'relp_version' 1545.993813183:7f862941c700: ConstructOffers syslog cmd state: 4 1545.993825574:7f862941c700: tcpSend returns 3 1545.993835129:7f862941c700: tcpSend returns 0 1545.993844318:7f862941c700: tcpSend returns 0 The last line gets spammed a few thousand times per second after that with nothing else happening. This does not happen on the servers that do work. So, I'm a bit lost on where to look next for troubleshooting, and would appreciate any thoughts on the matter. Thanks! -Gene _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
