Known and fixed bug. Upgrading librelp may be sufficient. Sent from phone, thus brief. Am 19.07.2013 19:25 schrieb "Gene" <[email protected]>:
> I'm having an odd issue on some 5.8.11 and 4.6.4 rsyslog servers when using > imrelp. Here's the relevant config snippet: > > $ModLoad imrelp > $InputrelpMaxSessions 5000 > $InputRELPServerRun 20514 > *.* ?hostsbydirectory;standardwithpri > & ~ > > Essentially what happens is that on the restart of the rsyslog service it > will accept a few lines worth of logs from some clients and then stop, > while pegging a core at 100% cpu utilization. In this state it still > accepts regular UDP and TCP syslog just fine. The odd part is that I have > identically configured and versioned servers where I triple checked rsyslog > config, sysctl parameters, etc, yet the imrelp bits work just fine there. > When running in debug mode, the only suspicious thing that I was able to > see is that after the relp session starts, a few seconds later this > happens: > > 1545.993749574:7f862941c700: tcpSend returns 105 > 1545.993757082:7f862941c700: in destructor: sendbuf 0x1fb93a0 > 1545.993767020:7f862941c700: relp engine is dispatching frame with command > 'open' > 1545.993774075:7f862941c700: in open command handler > 1545.993783213:7f862941c700: processing client offer 'commands' > 1545.993790284:7f862941c700: cmd syslog state in srv session: 4 > 1545.993798094:7f862941c700: processing client offer 'relp_software' > 1545.993805150:7f862941c700: processing client offer 'relp_version' > 1545.993813183:7f862941c700: ConstructOffers syslog cmd state: 4 > 1545.993825574:7f862941c700: tcpSend returns 3 > 1545.993835129:7f862941c700: tcpSend returns 0 > 1545.993844318:7f862941c700: tcpSend returns 0 > > The last line gets spammed a few thousand times per second after that with > nothing else happening. This does not happen on the servers that do work. > So, I'm a bit lost on where to look next for troubleshooting, and would > appreciate any thoughts on the matter. > > Thanks! > > -Gene > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
