[rsyslog-notify] Forum Thread: Re: rsyslog-7.4.4: using imklog+ompgsql causes 100% CPU usag - (Mode 'reply')

[noreply at adiscon.com]

User: chrisk 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=24290#p24290

Message: 
----------
Hi David,

thanks for your feedback.

[quote="dlang":251nlqyr]I don't think the ompgsql has anything to do with
the problem.

I do know that the process to get data from the kernel changed 'recently'
and I have run into problems before reading from the imklog
input.[/quote:251nlqyr]

I've tried this out and the problem really seems to be imklog+ompgsql. If I
drop either one, rsyslog behaves normally.

[quote="dlang":251nlqyr]I'd suggest first just commenting out the imklog
and see if we are still getting the kernel logs or not.[/quote:251nlqyr]

Nope, didn't receive anything.

[quote="dlang":251nlqyr]If not, my guess is that this is a permission
problem (one of those things that varies from distro to
distro)[/quote:251nlqyr]

That was my first thought as well (especially given the history between the
kernel and imklog you alluded to), but with the minimal config from my
previous post, rsyslogd is running as root.

[quote="dlang":251nlqyr]try launching rsyslog in debug mode  (-d -n) and
see if there are any messages about klog during startup. If nothing else,
this should identify what is being opened so that we can check the
permissions of it.[/quote:251nlqyr]

Now here's something interesting: [b:251nlqyr]running with -d -n caused the
problem to disappear. When running only with -d, it is still
present[/b:251nlqyr], however. So, it appears to be the combination of
imklog + ompgsql + auto-backgrounding.

[quote="dlang":251nlqyr]are you using SELinux or AppArmor by any
chance?[/quote:251nlqyr]

No, I am not.

Christian