[rsyslog-notify] Forum Thread: Re: imtcp maxsessions - (Mode 'reply')

[noreply at adiscon.com]

User: dlang 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=25673#p25673

Message: 
----------
[quote:2axle7wc]rsyslogd-pstats: main Q: origin=core.queue size=2
enqueued=882060 full=0 discarded.full=0 discarded.nf=0 maxqsize=70069
rsyslogd-pstats: imudp(w0): origin=imudp called.recvmmsg=0 called.recvmsg=0
msgs.received=0

^^^
(another thing I always wondered.. how can maxqsize=70069 when
enqueued=882060)
[/quote:2axle7wc]

enqueued is the total number of messages that have been added to the queue,
since messages are pulled from the queue and processed, the only time that
maxqsize is equal to enqueued is if no messages were delivered before the
last message arrived.

If messages are being delivered as they arrive, maxqsize is going to be
small. The fact that your maxqsize is 70K indicates that you are a very
significant backlog and are not delivering messages fast enough.

Rainer will have to comment on maxsessions.

you may want to look at using imptcp instead of imtcp, it is able to handle
higher loads (although it may not help with your problem)

One other trick you can pull when you have socket exhaustion is to
configure multiple IP addresses on the box and have some clients connect to
each of them.