[rsyslog-notify] Forum Thread: Re: Dequeue Perfomance - (Mode 'reply')

[noreply at adiscon.com]

User: dlang 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=25529#p25529

Message: 
----------
try setting impstats to a short timeframe (say 10 sec) and see what it's
doing.

this looks like the outbound RELP connections are stalling, timing out and
reconnecting (although this should show up as rsyslogd messages in your
logs.

at the time it crashed, your memory queue sizes were approaching the max,
try bumping them down from 500,000 to 400,000. The disk queue had not
started being used yet.

you can use the name="something" clause in your action() statements to name
the actions so they don't just show up as action #

looking at your 01:49 pstats data, you queued ~300K messages, but only
processed ~50K messages, so at this rate,  you will have problems

you are plotting queue stats (how many in the queue, how many delivered),
can you also plot the processed= stats showing how many are being delivered
over time? I'm interested to see if this changes when things start getting
in trouble or if it's just a matter of being overloaded.

if you can run top and show threads (the 'H' command to top) you can see
the different rsyslog threads independently, and it would be useful to know
which one is consuming so much cpu