enable impstats to see the queue sizes and resources consumed
David Lang
On Tue, 4 Feb 2020, John Chivian via rsyslog wrote:
Date: Tue, 4 Feb 2020 07:45:35 -0600
From: John Chivian via rsyslog <[email protected]>
To: [email protected]
Cc: John Chivian <[email protected]>
Subject: Re: [rsyslog] rsyslogd memory leak
That's probably not a memory leak, but rather rsyslog queuing the messages in
memory until the remote system is again available and the queue can be
drained.
Regards,
On 2/4/20 7:32 AM, Vini Harimoorthy via rsyslog wrote:
I am seeing rsyslogd memory leak when remote server is unreachable.
I tried to change resumeRetryCount ="0" & queue.size ="0", so that rsyslogd
won't care much about retrying when remote server becomes reachable again.
When remote server is reachable, it stays at 1.5MB.
*/home/admin# ps_mem | grep rsyslog*
* 1.5 MiB + 31.5 KiB = 1.5 MiB rsyslogd*
When remote server is unreachable, it is increasing by 1 MB. And it goes
upto 2GB after 24 hours .
/home/admin# ps_mem | grep rsyslog
1.6 MiB + 31.5 KiB = 1.6 MiB rsyslogd
/home/admin# ps_mem | grep rsyslog
1.6 MiB + 31.5 KiB = 1.6 MiB rsyslogd
/home/admin# ps_mem | grep rsyslog
1.6 MiB + 31.5 KiB = 1.6 MiB rsyslogd
/home/admin#
/home/admin# ps_mem | grep rsyslog
1.6 MiB + 31.5 KiB = 1.7 MiB rsyslogd
/home/admin# ps_mem | grep rsyslog
* 2.4 MiB + 31.5 KiB = 2.5 MiB rsyslogd*
/home/admin# date
Tue Feb 4 13:23:13 UTC 2020
/home/admin# ps_mem | grep rsyslog
* 3.8 MiB + 31.5 KiB = 3.8 MiB rsyslogd*
/home/admin# date
Tue Feb 4 13:26:32 UTC 2020
/home/admin# ps_mem | grep rsyslog
* 5.2 MiB + 31.5 KiB = 5.2 MiB rsyslogd*
When I made the remote server reachable again, it is reducing again
:/home/admin# date
Tue Feb 4 13:29:16 UTC 2020
:/home/admin# ps_mem | grep rsyslog
2.6 MiB + 31.5 KiB = 2.6 MiB rsyslogd
Could you please check this issue . Below is my remote configurations
*/home/admin# cat /etc/rsyslog.remote.conf*
$DefaultNetstreamDriverCAFile
/fs/security/certmgr/apps/syslog-client/syslog-client.crt
$DefaultNetstreamDriverCertFile
/fs/security/certmgr/apps/syslog-client/syslog-client.crt
$DefaultNetstreamDriverKeyFile
/fs/security/certmgr/apps/syslog-client/syslog-client.key
set $!updatepri = $syslogseverity + 184;
$template remoteFmt,"<%$!updatepri%>1 %TIMESTAMP:::date-rfc3339% %HOSTNAME%
%APP-NAME% %PROCID% %MSGID% %STRUCTURED-DATA%%msg%\n"
ruleset(name="logger1"){
action(type="omfwd" Target="20.20.20.2" Port="514" Protocol="tcp"
NetworkNamespace="swns" template="remoteFmt"Address="None"
*queue.type="LinkedList"
action.resumeRetryCount="-1" *queue.size="1000")
}
if($msg contains "Event|") then {
if $syslogseverity <= 6 then {
call logger1
}
}
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
