Hello, guys, I use impstats to read some statistics, and add some parameters in omfwd, which I think can improve the performance. My action is as below.
sender local5.* action(type="omfwd" Target="imi" Protocol="tcp" ZipLevel="6" compression.Mode="stream:always") receiver module(load="imptcp") input(type="imptcp" port="514" Compression.mode="stream:always") When I use the simplest action, local5.* @@imi, everything is ok but the output performance is bad. The output of impstats as below. sender Wed Dec 4 15:05:42 2019: global: origin=dynstats Wed Dec 4 15:05:42 2019: imuxsock: origin=imuxsock submitted=40466 ratelimit.discarded=0 ratelimit.numratelimiters=0 Wed Dec 4 15:05:42 2019: action 0: origin=core.action processed=40464 failed=40463 suspended=1 suspended.duration=240 resumed=0 Wed Dec 4 15:05:42 2019: resource-usage: origin=impstats utime=797631 stime=960894 maxrss=2228 minflt=614 majflt=0 inblock=0 oublock=16 nvcsw=77841 nivcsw=12 Wed Dec 4 15:05:42 2019: main Q: origin=core.queue size=0 enqueued=40466 full=0 discarded.full=0 discarded.nf=0 maxqsize=23 receiverWed Dec 4 15:06:43 2019: global: origin=dynstats Wed Dec 4 15:06:43 2019: imuxsock: origin=imuxsock submitted=247 ratelimit.discarded=0 ratelimit.numratelimiters=0 Wed Dec 4 15:06:43 2019: action 0: origin=core.action processed=17 failed=0 suspended=0 suspended.duration=0 resumed=0 Wed Dec 4 15:06:43 2019: action 1: origin=core.action processed=17 failed=0 suspended=0 suspended.duration=0 resumed=0 Wed Dec 4 15:06:43 2019: imptcp(*/514/IPv4): origin=imptcp submitted=0 bytes.received=0 bytes.decompressed=0 Wed Dec 4 15:06:43 2019: resource-usage: origin=impstats utime=40738 stime=57449 maxrss=1468 minflt=352 majflt=0 inblock=0 oublock=272 nvcsw=1993 nivcsw=6 Wed Dec 4 15:06:43 2019: main Q: origin=core.queue size=0 enqueued=247 full=0 discarded.full=0 discarded.nf=0 maxqsize=8 Wed Dec 4 15:06:43 2019: io-work-q: origin=imptcp enqueued=0 maxqsize=0 And it seems that this action always get failed. So I let rsyslog working in debug mode. One segment as below. 2895.100124307:imuxsock.c : --------imuxsock calling select, active file descriptors (max 3): 3 2895.100137835:main Q:Reg/w0 : wti 0x55ec79cbb350: worker awoke from idle processing 2895.100143227:main Q:Reg/w0 : DeleteProcessedBatch: we deleted 0 objects and enqueued 0 objects 2895.100147615:main Q:Reg/w0 : doDeleteBatch: delete batch from store, new sizes: log 1, phys 1 2895.100152305:main Q:Reg/w0 : main Q: dequeued 1 consumable elements, szlog 0 sz phys 1 2895.100158515:main Q:Reg/w0 : processBATCH: batch of 1 elements must be processed 2895.100162790:main Q:Reg/w0 : processBATCH: next msg 0: <172>Dec 4 15:01:35 qoe[14]: <9105990015> <WARN> |qoe| (QoeDataPayloadHandler.hpp:48) No such ap 00:98:C8:02:D8:27 on ac 00:00: 2895.100167327:main Q:Reg/w0 : PRIFILT 'local5.*' 2895.100175428:main Q:Reg/w0 : pmask: X X X X X X X X X X X X X X X X X X X X X FF X X X X 2895.100234999:main Q:Reg/w0 : PRIFILT condition result is 1 2895.100238495:main Q:Reg/w0 : ACTION 0 [builtin:omfwd:action(type="builtin:omfwd" ...)] 2895.100255413:main Q:Reg/w0 : executing action 0 2895.100259995:main Q:Reg/w0 : action 'action 0': called, logging to builtin:omfwd (susp 0/0, direct q 1) 2895.100266369:main Q:Reg/w0 : action 'action 0': is transactional - executing in commit phase 2895.100272166:main Q:Reg/w0 : actionTryResume: action 0x55ec79cc5580 state: susp, next retry (if applicable): 1575442922 [now 1575442895] 2895.100276669:main Q:Reg/w0 : action 'action 0': set suspended state to 1 2895.100280944:main Q:Reg/w0 : END batch execution phase, entering to commit phase [processed 1 of 1 messages] 2895.100285603:main Q:Reg/w0 : actionCommitAllDirect: action 0, state 4, nbr to commit 1 isTransactional 1 2895.100289755:main Q:Reg/w0 : processBATCH: batch of 1 elements has been processed 2895.100294320:main Q:Reg/w0 : regular consumer finished, iret=0, szlog 0 sz phys 1 2895.100298526:main Q:Reg/w0 : DeleteProcessedBatch: etry 0 state 3 2895.100303403:main Q:Reg/w0 : DeleteProcessedBatch: we deleted 1 objects and enqueued 0 objects 2895.100307640:main Q:Reg/w0 : doDeleteBatch: delete batch from store, new sizes: log 0, phys 0 2895.100312361:main Q:Reg/w0 : main Q: dequeued 0 consumable elements, szlog 0 sz phys 0 2895.100317004:main Q:Reg/w0 : regular consumer finished, iret=4, szlog 0 sz phys 0 2895.100320993:main Q:Reg/w0 : main Q:Reg/w0: worker IDLE, waiting for work. 2895.101410351:imuxsock.c : Message from UNIX socket: #3 2895.101425449:imuxsock.c : main Q: qqueueAdd: entry added, size now log 1, phys 1 entries 2895.101432600:imuxsock.c : main Q: EnqueueMsg advised worker start So what the right thing I can do? Thank you _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
