> does it show the imtcp thread using 100% cpu? if so, you may have run into a > problem that I am occasionally having.
No, not at all. Not on my standby which I have isolated and am using to debug this PAN issue. However, speak of the devil, I went and checked my production box and it is exactly as you say. And, Proofpoint logging has indeed stopped (last night at 11:24pmCST). Note that Proofpoint is the only other source that uses imtcp. The bulk of the sources are non-SSL and use imptcp. And they never seem to have any trouble. I have run into issues over the last few months with Proofpoint and/or PAN logging stopping. In an attempt to debug, I pointed Proofpoint to our standby server over a month ago, and the 100% CPU issue ended and all logging worked. Within a few days, the PAN logging stopped, but the 100% CPU did not take place. Proofpoint logging to the standby continued. Yesterday I pointed Proofpoint back to our production server so I could test PAN on the standby, and Proofpoint logging worked fine until last night. I have just blocked via iptables connections from the PAN devices to our primary (not working anyway) and have restarted rsyslog. Proofpoint logs are flowing again. I will focus now on the PAN devices and our standby server. This does not make a lot of sense yet. It seems: PAN and Proofpoint logging together led to the 100% CPU issue, and both logs stopped. Proofpoint logging alone worked fine (though I do see some ossl syslog error messages similar to what I see for PAN). PAN logging (no Proofpoint) stopped; no CPU load issue. Can't even get it working on standby, rsyslog restarts, etc. Tod A. Sandman Office of Information Technology Rice University _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
