[rsyslog-notify] Forum Thread: imtcp maxsessions - (Mode 'edit_topic')

[noreply at adiscon.com]

User: nottoosmart 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=25672#p25672

Message: 
----------
What exactly does maxsessions do?

I was under the impression that is would limit the number of connections to
your rsyslog instance.
In my config I do not specify maxsessions.  According to the documentation,
the default is 200.  Clearly this is not obeyed:
netstat -anT | grep :514| grep ESTABLISHED|wc -l
14230

Here is some output from my /proc/PID/limits file for rsyslog which is
running:
cat /proc/351024/limits
Limit                     Soft Limit           Hard Limit           Units
Max cpu time              unlimited            unlimited            seconds
Max file size             unlimited            unlimited            bytes
Max data size             unlimited            unlimited            bytes
Max stack size            8388608              unlimited            bytes
Max core file size        30720000000          30720000000          bytes
Max resident set          unlimited            unlimited            bytes
Max processes             127110               127110              
processes
Max open files            65535                65535                files
Max locked memory         65536                65536                bytes
Max address space         unlimited            unlimited            bytes
Max file locks            unlimited            unlimited            locks
Max pending signals       127110               127110               signals
Max msgqueue size         819200               819200               bytes
Max nice priority         0                    0
Max realtime priority     0                    0
Max realtime timeout      unlimited            unlimited            us

Here is some output from the rsyslog-pstats output (ignore UDP and RELP as
they aren't being used at this time.. also action 13,14, and 15 are my
workhorses.):
 rsyslogd-pstats: action 13: origin=core.action processed=874589 failed=0
suspended=0 suspended.duration=12120 resumed=0
 rsyslogd-pstats: action 14: origin=core.action processed=874589 failed=0
suspended=0 suspended.duration=3270 resumed=0
 rsyslogd-pstats: action 15: origin=core.action processed=874589 failed=0
suspended=0 suspended.duration=3330 resumed=0
 rsyslogd-pstats: imudp(*:514): origin=imudp submitted=0
 rsyslogd-pstats: imudp(*:514): origin=imudp submitted=0
 rsyslogd-pstats: imtcp(514): origin=imtcp submitted=874589
 rsyslogd-pstats: imrelp[5040]: origin=imrelp submitted=0
 rsyslogd-pstats: resource-usage: origin=impstats utime=42612422000
stime=153064658000 maxrss=3282612 minflt=258279349 majflt=11 inblock=1024
oublock=2371312 nvcsw=1649772604 nivcsw=16394055
 rsyslogd-pstats: main Q: origin=core.queue size=2 enqueued=882060 full=0
discarded.full=0 discarded.nf=0 maxqsize=70069
 rsyslogd-pstats: imudp(w0): origin=imudp called.recvmmsg=0
called.recvmsg=0 msgs.received=0

^^^
(another thing I always wondered.. how can maxqsize=70069 when
enqueued=882060)

In-case you're wondering about my environment, this is just 1 example of
many syslog aggregator servers we have.  We have a hardware load balanced
setup with 60 servers running rsyslog as a server and almost 800,000
clients.  I've had trouble with maxing out sockets, I've played with TCP
timeout settings which helped me, but not sure if it's the root cause.  A
lot of these servers get failures with health checks on port 514.  It's a
basic TCP connect check, it's flappy.  I'm just trying to understand where
and what I can tune.  maxsessions seems like a reasonable place to start)