[rsyslog-notify] Forum Thread: Re: Rate limiting - (Mode 'edit_last_post')

[noreply at adiscon.com]

User: teifler 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=25511#p25511

Message: 
----------
Hi,

first of all I have to tell you that v5.8.11 is very old and have many
fixed bugs inside! So I highly recommend you to upgrade to a newer version.
The actually stable version is V8.9.0, you can download the tar ball of the
latests stable version over the link below:
<!-- m --><a class="postlink"
href="http://www.rsyslog.com/downloads/download-v8-stable/">http://www.rsyslog.com/downloads/download-v8-stable/</a><!--
m -->

Here you can find a guide for the installation of the newer version: 
<!-- m --><a class="postlink"
href="http://www.rsyslog.com/newbie-guide-to-rsyslog/">http://www.rsyslog.com/newbie-guide-to-rsyslog/</a><!--
m -->

With your rate limiting configuration you "can" generates traffic lost
[quote="shivam99aa":11i9sr29]
$SystemLogRateLimitInterval 5 
$SystemLogRateLimitBurst 10000
[/quote:11i9sr29]
Because this rate limit is a protection and means if there are over 10000
messages in 5 secounds then rsyslog should discard the residual messages.

But If you disabled rate limiting ($SystemLogRateLimitInterval 0) and still
have traffic lost then this message lost isn't because of the rate
limiting! I think that you loose the traffic at receiving or sending. Do
you use UDP if so then please change to TCP because there should be no
traffic lost.

So can you please try to reproduce the problem under a newer version? If
you can't do this or this problem still occurs then please post your
complete configuration!

Best regards,
Tim Eifler