Re: Load balancer - that makes sense to me as well.
I've added this line to our config, does it seem appropriate for pstats? Our
Linux team keeps a tight grip on rights, so i'm pretty limited in what I can
do/access outside of rsyslog and the SIEM agent configs... I'll have to write
the file out where I can actually access it (rolleyes)
module(load="impstats" interval="30" ruleset="pstats_rule")
ruleset(name="pstats_rule") {
action(type="omfile"
File="/var/log/rsyslog_pstats.log"
FileCreateMode="0744"
FileOwner="loguser"
FileGroup="loguser")
}
Running Top + H now to get a feel on resource usage, but at first glance
nothing is really about 1~2%
________________________________
From: David Lang <da...@lang.hm>
Sent: Sunday, April 24, 2022 10:39 AM
To: Steven D <pheerl...@hotmail.com>
Cc: David Lang <da...@lang.hm>; Steven D via rsyslog <rsyslog@lists.adiscon.com>
Subject: Re: [rsyslog] Basic Rsyslog Troubleshooting
On Sun, 24 Apr 2022, Steven D wrote:
> Would setting the KeepAlives in the rsyslog config on the server-side help to
> manage the (zombie?) TCP connections.?
>
> * The load balancer being in the middle feels like it's the cause of
> repeated ESTABLISHED connections, but to keep HA/redundancy it's kind of a
> necessary evil.
by the way, I think the fact that the load balancer cuts the connection and the
server doesn't know it's cut and has to wait for it to time out (a very long
time) is the cause of the large number of ESTABLISHED connections
David Lang
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
