[rsyslog-notify] Forum Thread: Re: Dequeue Perfomance - (Mode 'reply')

[noreply at adiscon.com]

User: kamermans 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=25533#p25533

Message: 
----------
I've set the impstats report interval to 10 seconds, so I'll have more
granular data tomorrow, but I was able to scrape the data from the period
that's currently in question.

Here's the stats on the forwardPartition1 queue (times are in my local time
like the other graphs):

[img:22sc0woi]http://s14.postimg.org/q9qh0yl4x/stats12.png[/img:22sc0woi]

And here's forwardPartition2:

[img:22sc0woi]http://s27.postimg.org/w5jkqo2qb/stats13.png[/img:22sc0woi]

The graphs clearly show that there is no delay between imudp and the queue
(forwardPartitionX).

There is, just as you suggested, a major problem getting through the RELP
action.  One thing I noticed is that the Disk-Assist kicked in a few
intervals after processing dropped out, so it's not like the DA is a kiss
of death here.

It seems like the most likely scenario is that my server is able to keep up
normally, but just barely, and if anything interrupts the outbound action
processing (network interruption, etc), the cost of queuing and dequeuing
is too great and the system (or network) cannot keep up.

The strange thing here is that for most of the event (19:00 - 23:00), the
system is actually processing less than half of the traffic that it seemed
to do just fine with a few hours before.  Additionally, after 19:00, the
action is not even able to keep up with the normal traffic rate, let alone
all the messages piling up in the queues.