[rsyslog-notify] Forum Thread: Re: Rate limiting - (Mode 'reply')

[noreply at adiscon.com]

User: shivam99aa 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=25513#p25513

Message: 
----------
[quote="teifler":1okku7q5]

first of all I have to tell you that v5.8.11 is very old and have many
(old) bugs inside! So I highly recommend you to upgrade to a newer version.
The actually stable version is V8.9.0, you can download the tar ball of the
latests stable version over the link below:
<!-- m --><a class="postlink"
href="http://www.rsyslog.com/downloads/download-v8-stable/">http://www.rsyslog.com/downloads/download-v8-stable/</a><!--
m -->

Here you can find a guide for the installation of the newer version: 
<!-- m --><a class="postlink"
href="http://www.rsyslog.com/newbie-guide-to-rsyslog/">http://www.rsyslog.com/newbie-guide-to-rsyslog/</a><!--
m -->
[/quote:1okku7q5]
yeah i understand that the version i am using is very old but this is the
version i am using in production. It might be difficult for me to upgrade
it.
[quote="teifler":1okku7q5]
With your rate limiting configuration you "can" generates traffic lost
[quote="shivam99aa":1okku7q5]
$SystemLogRateLimitInterval 5 
$SystemLogRateLimitBurst 10000
[/quote:1okku7q5]
Because this rate limit is a protection and means if there are over 10000
messages in 5 secounds then rsyslog should discard the residual messages.
[/quote:1okku7q5]
yeah i know that above 10000 messages in 5 seconds it will start losing
messages. But i tried first with setting ratelimitburst to 2000 and i was
loosing messages and then to test i set it to 10000 and still i am losing
messages with more or less same frequency. This is what is bugging me since
after increasing to 10000 messages should not be lost.
At present i have set ratelimitinterval to 1 and  i am still losing
messages.
[quote="teifler":1okku7q5]
But If you disabled rate limiting ($SystemLogRateLimitInterval 0) and still
have traffic lost then this message lost isn't because of the rate
limiting! I think that you loose the traffic at receiving or sending. Do
you use UDP if so then please change to TCP because there should be no
traffic lost.

So can you please try to reproduce the problem under a newer version? If
you can't do this or this problem still occurs then please post your
complete configuration!

Best regards,
Tim Eifler[/quote:1okku7q5]
I disabled rate limiting and even after that rsyslog is logging like this

rsyslogd-2177: imuxsock begins to drop messages from pid 25810 due to
rate-limiting
rsyslogd-2177: imuxsock lost 103 messages from pid 25810 due to
rate-limiting

This is the way it use to log in case of rate-limiting and was logging
before disabling rate-limiting.  I think rate-limiting is also at work here
even after disabling it.
I do not think that UDP is the reason for this.

Thanks
shivam shukla