[rsyslog-notify] Forum Thread: Re: How to Determine Message Drops ? - (Mode 'reply')

[noreply at adiscon.com]

User: jtsai.cp 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=25950#p25950

Message: 
----------
Great explanation, thank you.

1. I need to ship logs for 900 servers/devices total.  Current test, I have
110 Windows servers shipping logs to RSyslog each with it's own file a CIFS
Share (our Senior Admin demanded writing to Windows share each server per
files, no batch copies but direct writes) there are over 100 open files, we
are writing to Windows 2012 R2 share.  On top of that, the Windows box
reboot weekly (another issue that is killing RSyslog, seems autofs not too
good or badly configured).   

2. Performance wise, the SAN, ESXi, VM never gets too heavily used in terms
of IOPS, transfer, CPU, and memory.  We are running new 3par, sas/ssd,
fibre, HP gen9, 10Gb etc.... I can give it as much resources as it is
needed to handle the load it is capable of.

3. Moving the "*.* ?RemoteLogs" down toward the bottom causes all logs goes
into log files under /var/logs/messages and bootlog and it never gets
processed, one big log file locally instead of specified one for each host
on CIFS share.

4. I should move all the following above the "*.* ?Remote....." ?
$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
$ActionQueueType LinkedList # run asynchronously
$ActionResumeRetryCount -1 # infinite retries if host is down
$ActionQueueWorkerThreadMinimumMessages 1000
$ActionQueueWorkerThreads 5
$ActionQueueWorkerTimeoutThreadShutdown 0
$ActionQueueDequeueBatchSize 5000
$ActionQueueSize="100000"

5. I did set the OMBuffer, maybe need to be larger...
$OMFileIOBufferSize 256k