[rsyslog-notify] Forum Thread: Re: imtcp maxsessions - (Mode 'reply')

[noreply at adiscon.com]

User: dlang 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=25677#p25677

Message: 
----------
Ok, there should be a LOT of room for optimization here. I've done 100K
logs/sec (saturating 1G ethernet with an average of ~256 bytes/message) and
I've worked with others handling up to ~400K logs/sec on a single box, the
fact that you have 60 says that either you're doing something really
complex, or something's wrong.

In my case, I had the relays setup in failover pairs. I had ~30 pairs of
relays scattered around the company, relaying to a single central box that
did some processing and forwarded to other farms of boxes for more complex
stuff. I didn't need so many relays for the load, but rather because I
wanted to have a relay on the same subnet as every sender (using UDP for
the first hop to the relays and didn't want firewalls/routers/chokepoints
dropping the log messages)

This was only from a few thousand systems, so there may be something with
so many connections that causes grief, but with four regions, you shouldn't
need very many systems in each region.

can you share your config? v8.8 is pretty current, so you should not have
any issues from there.