[rsyslog] Out of memory

Rainer Gerhards rgerhards at hq.adiscon.com
Thu Jan 12 12:04:19 CET 2017


Have a look what impstats tells you. I guess some queue is defined very
large and fills up.

Rainer

2017-01-12 12:01 GMT+01:00 mostolog--- via rsyslog <
rsyslog at lists.adiscon.com>:

> Hi
>
>
> At this moment, our testing rsyslog is receiving messages from relay
> through RELP in RFC3164 format with message in JSON like:
>
>   <PRI>DATE RELAYHOST TAG: {"field":"foo",..."data":"orig
> inal_forwarded_message"}
>
> Once received, mmjsonparse is executed over MSG to check if incoming
> messages "comply", before mmnormalize on data (actually doing nothing due
> to liblognorm bugs already reported) and setting some other fields.
>
> After that, omelasticsearch action is executed and messages are indexed.
>
> We are receiving ~1 million events/hour and rsyslog has 2GB of memory and
> process is killed cause out of memory (every other hour).
>
> What steps could we take to diagnose if that's correct, how to avoid
> it...? Any up to date literature?
>
>
> Thanks. Regards
>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> DON'T LIKE THAT.
>


More information about the rsyslog mailing list