[rsyslog] imjournal does not respect $imjournalRatelimitBurst value?

David Goudet david.goudet at lyra-network.com
Mon Sep 4 18:33:17 CEST 2017


Hello,

I have dropped logs due to imjournal module.

To prevent this, i am using following configuration:

$imjournalRatelimitInterval 30
$imjournalRatelimitBurst 80000

But after some tests with following script, logs are dropped again.

import syslog

syslog.openlog(facility=syslog.LOG_DAEMON, ident="test-conf-log-rate")

for i in range(1,80000):
    syslog.syslog("yy: " + str(i))

syslog.closelog()
print "end"

Generated logs are:
rsyslogd-2177: imjournal: begin to drop messages due to rate-limiting
rsyslogd-2177: imjournal: 65537 messages lost due to rate-limiting

I have try to send 60 000 logs, but result is same.
rsyslogd-2177: imjournal: begin to drop messages due to rate-limiting
rsyslogd-2177: imjournal: 45201 messages lost due to rate-limiting

With $imjournalRatelimitInterval 0 (rate limit disabled) there is no log dropped after tests => configuration works as excepted

My environment is: Centos 7.3, rsyslog-7.4.7-16.el7.x86_64

Journald configuration is ok and logs are present in journald database.
RateLimitInterval=30s
RateLimitBurst=160000

I don't understand why rsyslog dropped logs with this configuration.
Is there any parameters missing on imjournal configuration to prevent log dropping? 

Is it known problem?

Thank you for your help

-- 
David GOUDET 

LYRA NETWORK 
IT Operations service
Tel : +33 (0)5 32 09 09 74 | Poste : 574


More information about the rsyslog mailing list