Sorry for being late to the discussion. I would need to check, but I guess this is ipv4 and ipv6, which possibly are not clearly indicated. Could this be the case?
Rainer El mar., 14 jul. 2020 a las 15:49, Peter Viskup via rsyslog (<[email protected]>) escribió: > > Hi Ángel, > might be related to the ruleset in input configuration. > Use the Name and Name.appendPort options to specify the name of that input > for your ruleset. > https://www.rsyslog.com/doc/v8-stable/configuration/modules/imudp.html#name > > The other input reporting stats could be initialized by default ruleset > which is always defined. > https://www.rsyslog.com/doc/v8-stable/concepts/multi_ruleset.html > > According to the docu > <https://www.rsyslog.com/doc/v8-stable/concepts/multi_ruleset.html#what-does-to-bind-to-a-ruleset-mean> > - is the ruleset already defined when input is being initialised? > That might lead to this behaviour. > > Peter > > On Thu, Jul 9, 2020 at 1:43 PM Ángel L. Mateo via rsyslog < > [email protected]> wrote: > > > Hi, > > > > I have activated the stats in rsyslog to log to syslog stats > > entries. > > My problem is that udp stats are doubled twice. > > > > My configuration is: > > > > module(load="impstats" > > interval="60" > > format="json" > > > > ) > > module(load="imudp") > > input(type="imudp" > > address="*" > > port="514" > > ruleset="remote_udp" > > ) > > ... > > > > I don't have any other udp input. > > > > With this configuration, anytime that stats are recorded I get: > > > > Jul 9 13:35:56 pitufo41 rsyslogd-pstats: { "name": "imudp(*:514)", > > "origin": "imudp", "submitted": 64559362, "disallowed": 0 } > > Jul 9 13:35:56 pitufo41 rsyslogd-pstats: { "name": "imudp(*:514)", > > "origin": "imudp", "submitted": 0, "disallowed": 0 } > > Jul 9 13:35:56 pitufo41 rsyslogd-pstats: { "name": "imudp(w0)", > > "origin": "imudp", "called.recvmmsg": 42316004, "called.recvmsg": 0, > > "msgs.received": 64559362 } > > > > The imupd(w0) is correctly documented in > > > > https://www.rsyslog.com/doc/v8-stable/configuration/modules/imudp.html#imudp-statistic-counter > > as the worker statistics. > > > > But I don't know I'm getting two records for input imudp(*:514). > > For > > other inputs like tcp or relp (I'm using too) I don't have such > > duplicity. For example: > > > > Jul 9 13:39:58 pitufo31 rsyslogd-pstats: { "name": "imrelp(20514)", > > "origin": "imrelp", "submitted": 35531697 } > > Jul 9 13:39:58 pitufo31 rsyslogd-pstats: { "name": "imtcp(514)", > > "origin": "imtcp", "submitted": 0 } > > Jul 9 13:40:58 pitufo31 rsyslogd-pstats: { "name": "imrelp(20514)", > > "origin": "imrelp", "submitted": 35619726 } > > Jul 9 13:40:58 pitufo31 rsyslogd-pstats: { "name": "imtcp(514)", > > "origin": "imtcp", "submitted": 0 } > > > > I'm running rsyslog 8.2006.0-0adiscon2bionic1. > > > > Any idea of why this? > > > > -- > > Angel L. Mateo Martínez > > Sección de Telemática > > Área de Tecnologías de la Información > > y las Comunicaciones Aplicadas (ATICA) > > http://www.um.es/atica > > Tfo: 868889150 > > Fax: 868888337 > > _______________________________________________ > > rsyslog mailing list > > https://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > DON'T LIKE THAT. > _______________________________________________ > rsyslog mailing list > https://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
