How to face situation when client(s) sending burst of messages to TCP input? The receiver is forwarding those messages for further processing where we want to "limit the peaks". Forwarding and processing servers run rsyslog, not all clients run rsyslogs.
Standard imtcp module has ratelimit options which limit message bursts for whole TCP input socket and are not client/connection related. Seems reasonable to "properly" set dequeueslowdown and dequeuebatchsize options for omfwd and let the receiver to queue all these messages and forward for further processing on reasonable rate. This might cause the delay on all messages received. The other way should be to configure the same options on clients (wherever available) or TCP input ratelimit on message processing server. Where and how to deal with such bursts at best? What is your experience? -- Peter _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
