[rsyslog-notify] Forum Thread: Re: rsyslog 7.6.1/7.6.2 stability - (Mode 'reply')

[noreply at adiscon.com]

User: jeff 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=24431#p24431

Message: 
----------
[quote="dlang":17fpo120]If memory use is growing, it's very possible that
you have a queue filling up.

I would suggest that you enable the impstats module and have it write data
directly to a file at a fairly frequent pace so that you can see what's
happening to the queue sizes.

If you see some queue that's growing up until the point that things die,
it's very possible that something is killing it.[/quote:17fpo120]
Yep... per the troubleshooting guidelines, I had set up impstats for all of
the rsyslog servers... I only have the "Main Q" message queue, and
generally size is static at 24... though I do see occasional bumps in the
10s-of-thousands and have also tracked maxqsize over time and have seen it
bump up when size is reporting 24... so seemingly somewhere in the interval
window it has grown then processed the queue... None of the bumps in queue
size relate directly to the memory growth though, and memory use does seem
to stabilize once rsyslogd's been running awhile (but higher under v7 with
DNS resolution than under v5 without) so I don't think this is really an
issue.

[quote="dlang":17fpo120]check dmesg to see if the kernel is logging
anything around the time that rsyslog is getting killed (like the OOM
killer getting invoked)
[/quote:17fpo120]
Nope... nothing specific to rsyslogd from dmesg, nothing near the time
rsyslog stops.

[quote="dlang":17fpo120]In your case, something is sending the SIGABRT
signal to rsyslog, it's not rsyslog crashing, it's something else deciding
that rsyslog should no longer be running.[/quote:17fpo120]
I presume this has something to do with setting CHECK_MALLOC_=2 (per the
troubleshooting guide), as it does not exhibit this behavior with this
setting unset.

rsyslogd is still "randomly" stopping at seemingly random times. I've had
it happen twice over the weekend but have had it running over 48 hours on
the others. All are getting approximately the same volume of messages.