This is showing that your omfwd is running into grief delivering messages.
I have also seen the queue sizes exceed what's configured by a few percentage, I don't know the reason for that. I suspect that it has something to do with the batch size and batches being counted rather than individual messages (at least in some cases), I know rate limiting is based on batches rather than individual messages, but didn't think queue size checking worked that way.
David Lang On Fri, 19 Apr 2024, Tan Mientras via rsyslog wrote:
Date: Fri, 19 Apr 2024 14:12:36 +0200 From: Tan Mientras via rsyslog <rsyslog@lists.adiscon.com> To: rsyslog-users <rsyslog@lists.adiscon.com> Cc: Tan Mientras <tanimient...@gmail.com> Subject: Re: [rsyslog] Too many queue files A brief update: Upgraded to v8.2404.0. After a few minutes running, statistics seems to show interesting info: Fri Apr 19 13:56:38 2024: imudp(w0): origin=imudp called.recvmmsg=9768601 called.recvmsg=0 msgs.received=18432627 Fri Apr 19 13:57:38 2024: global: origin=dynstats Fri Apr 19 13:57:38 2024: global: origin=percentile Fri Apr 19 13:57:38 2024: TCP-mytarget-10514: origin=omfwd bytes.sent=9803793720 Fri Apr 19 13:57:38 2024: action-0-builtin:omfwd: origin=core.action processed=17587820 failed=14461 suspended=1 suspended.duration=30 resumed=1 Fri Apr 19 13:57:38 2024: imudp(*/514/IPv4): origin=imudp submitted=18715432 disallowed=0 Fri Apr 19 13:57:38 2024: imtcp(601): origin=imtcp submitted=0 Fri Apr 19 13:57:38 2024: imrelp(20514): origin=imrelp submitted=0 Fri Apr 19 13:57:38 2024: resource-usage: origin=impstats utime=214055198 stime=132473541 maxrss=156440 minflt=261166 majflt=28768 inblock=15373224 oublock=16853048 nvcsw=6683983 nivcsw=10414022 openfiles=16 Fri Apr 19 13:57:38 2024: ruleset[DA]: origin=core.queue size=1030656 enqueued=9118705 full=7590 discarded.full=4 discarded.nf=0 maxqsize=1080585 Fri Apr 19 13:57:38 2024: ruleset: origin=core.queue size=100000 enqueued=18715430 full=6983 discarded.full=5 discarded.nf=0 maxqsize=100000 Fri Apr 19 13:57:38 2024: main Q[DA]: origin=core.queue size=0 enqueued=0 full=0 discarded.full=0 discarded.nf=0 maxqsize=0 Fri Apr 19 13:57:38 2024: main Q: origin=core.queue size=0 enqueued=0 full=0 discarded.full=0 discarded.nf=0 maxqsize=0 Fri Apr 19 13:57:38 2024: imudp(w0): origin=imudp called.recvmmsg=9924190 called.recvmsg=0 msgs.received=18715432 Fri Apr 19 13:58:38 2024: global: origin=dynstats Fri Apr 19 13:58:38 2024: global: origin=percentile Fri Apr 19 13:58:38 2024: TCP-mytarget-10514: origin=omfwd bytes.sent=9982666166 Fri Apr 19 13:58:38 2024: action-0-builtin:omfwd: origin=core.action processed=17897068 failed=14461 suspended=1 suspended.duration=30 resumed=1 Fri Apr 19 13:58:38 2024: imudp(*/514/IPv4): origin=imudp submitted=19017066 disallowed=0 Fri Apr 19 13:58:38 2024: imtcp(601): origin=imtcp submitted=0 Fri Apr 19 13:58:38 2024: imrelp(20514): origin=imrelp submitted=0 Fri Apr 19 13:58:38 2024: resource-usage: origin=impstats utime=217781728 stime=134680589 maxrss=156604 minflt=262499 majflt=29146 inblock=15656880 oublock=17128640 nvcsw=6793159 nivcsw=10589931 openfiles=15 *Fri Apr 19 13:58:38 2024: ruleset[DA]: origin=core.queue size=1029133 enqueued=9264638 full=7733 discarded.full=4 discarded.nf <http://discarded.nf>=0 maxqsize=1080585 * Fri Apr 19 13:58:38 2024: ruleset: origin=core.queue size=93391 enqueued=19017044 full=7109 discarded.full=5 discarded.nf=0 maxqsize=100000 Fri Apr 19 13:58:38 2024: main Q[DA]: origin=core.queue size=0 enqueued=0 full=0 discarded.full=0 discarded.nf=0 maxqsize=0 Fri Apr 19 13:58:38 2024: main Q: origin=core.queue size=0 enqueued=0 full=0 discarded.full=0 discarded.nf=0 maxqsize=0 Fri Apr 19 13:58:38 2024: imudp(w0): origin=imudp called.recvmmsg=10081057 called.recvmsg=0 msgs.received=19017066 *Why is size(=1029133) greater than configured queue.size(="100000")? Am I missing something?* _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
