[rsyslog-notify] Forum Thread: Re: rsyslog 7.6.1/7.6.2 stability - (Mode 'reply')

[noreply at adiscon.com]

User: dlang 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=24415#p24415

Message: 
----------
If memory use is growing, it's very possible that you have a queue filling
up.

I would suggest that you enable the impstats module and have it write data
directly to a file at a fairly frequent pace so that you can see what's
happening to the queue sizes.

If you see some queue that's growing up until the point that things die,
it's very possible that something is killing it.

check dmesg to see if the kernel is logging anything around the time that
rsyslog is getting killed (like the OOM killer getting invoked)

In your case, something is sending the SIGABRT signal to rsyslog, it's not
rsyslog crashing, it's something else deciding that rsyslog should no
longer be running.