Just discovered the same on our infra. Will test by disabling IPV6 and confirm if Ángel will not answer sooner.
Peter On Tue, Jul 14, 2020 at 4:02 PM Rainer Gerhards <[email protected]> wrote: > Sorry for being late to the discussion. > > I would need to check, but I guess this is ipv4 and ipv6, which > possibly are not clearly indicated. Could this be the case? > > Rainer > > El mar., 14 jul. 2020 a las 15:49, Peter Viskup via rsyslog > (<[email protected]>) escribió: > > > > Hi Ángel, > > might be related to the ruleset in input configuration. > > Use the Name and Name.appendPort options to specify the name of that > input > > for your ruleset. > > > https://www.rsyslog.com/doc/v8-stable/configuration/modules/imudp.html#name > > > > The other input reporting stats could be initialized by default ruleset > > which is always defined. > > https://www.rsyslog.com/doc/v8-stable/concepts/multi_ruleset.html > > > > According to the docu > > < > https://www.rsyslog.com/doc/v8-stable/concepts/multi_ruleset.html#what-does-to-bind-to-a-ruleset-mean > > > > - is the ruleset already defined when input is being initialised? > > That might lead to this behaviour. > > > > Peter > > > > On Thu, Jul 9, 2020 at 1:43 PM Ángel L. Mateo via rsyslog < > > [email protected]> wrote: > > > > > Hi, > > > > > > I have activated the stats in rsyslog to log to syslog stats > > > entries. > > > My problem is that udp stats are doubled twice. > > > > > > My configuration is: > > > > > > module(load="impstats" > > > interval="60" > > > format="json" > > > > > > ) > > > module(load="imudp") > > > input(type="imudp" > > > address="*" > > > port="514" > > > ruleset="remote_udp" > > > ) > > > ... > > > > > > I don't have any other udp input. > > > > > > With this configuration, anytime that stats are recorded I get: > > > > > > Jul 9 13:35:56 pitufo41 rsyslogd-pstats: { "name": "imudp(*:514)", > > > "origin": "imudp", "submitted": 64559362, "disallowed": 0 } > > > Jul 9 13:35:56 pitufo41 rsyslogd-pstats: { "name": "imudp(*:514)", > > > "origin": "imudp", "submitted": 0, "disallowed": 0 } > > > Jul 9 13:35:56 pitufo41 rsyslogd-pstats: { "name": "imudp(w0)", > > > "origin": "imudp", "called.recvmmsg": 42316004, "called.recvmsg": 0, > > > "msgs.received": 64559362 } > > > > > > The imupd(w0) is correctly documented in > > > > > > > https://www.rsyslog.com/doc/v8-stable/configuration/modules/imudp.html#imudp-statistic-counter > > > as the worker statistics. > > > > > > But I don't know I'm getting two records for input > imudp(*:514). > > > For > > > other inputs like tcp or relp (I'm using too) I don't have such > > > duplicity. For example: > > > > > > Jul 9 13:39:58 pitufo31 rsyslogd-pstats: { "name": "imrelp(20514)", > > > "origin": "imrelp", "submitted": 35531697 } > > > Jul 9 13:39:58 pitufo31 rsyslogd-pstats: { "name": "imtcp(514)", > > > "origin": "imtcp", "submitted": 0 } > > > Jul 9 13:40:58 pitufo31 rsyslogd-pstats: { "name": "imrelp(20514)", > > > "origin": "imrelp", "submitted": 35619726 } > > > Jul 9 13:40:58 pitufo31 rsyslogd-pstats: { "name": "imtcp(514)", > > > "origin": "imtcp", "submitted": 0 } > > > > > > I'm running rsyslog 8.2006.0-0adiscon2bionic1. > > > > > > Any idea of why this? > > > > > > -- > > > Angel L. Mateo Martínez > > > Sección de Telemática > > > Área de Tecnologías de la Información > > > y las Comunicaciones Aplicadas (ATICA) > > > http://www.um.es/atica > > > Tfo: 868889150 > > > Fax: 868888337 > > > _______________________________________________ > > > rsyslog mailing list > > > https://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com/professional-services/ > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > myriad > > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > > DON'T LIKE THAT. > > _______________________________________________ > > rsyslog mailing list > > https://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
