[rsyslog-notify] Forum Thread: Re: How to Determine Message Drops ? - (Mode 'reply')

[noreply at adiscon.com]

User: dlang 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=25945#p25945

Message: 
----------
[quote="jtsai.cp":36l92dxz]Thanks for the explanation.  So based on that,
messages are being dropped since MainQ was set to 1,000,000
(maxqsize=1000000).

Sat Sep 12 23:30:49 2015: main Q: origin=core.queue size=129550
enqueued=171038 full=0 discarded.full=0 discarded.nf=0 maxqsize=1000000 
Sat Sep 12 23:30:49 2015: imudp(w0): origin=imudp called.recvmmsg=315616
called.recvmsg=0 msgs.received=171023

But seems there is no way to tell how much a system can handle as I can
increase the MainQ to 100 million and never know packets are dropped?
Rate Limit can't tell either because I can just increase the
threshhold?[/quote:36l92dxz]

how many messages a system can handle depends on a lot of things, including
the length of the messages, what processing you are doing, what else is
running on the system (and if you are using a SAN, how busy the SAN is)

there have beene xamples of stripped down rsyslog instances handling 1m
logs/sec. I've run systems in production that handled several hundred
thousand logs/sec. i've seen other configus that had trouble at several
hundred logs/sec.

by looking at the impstats, you can see if a particular system is having
trouble with the logs you are sending it, and we can make suggesions on
ways to improve performance of a particular config.