[rsyslog-notify] Forum Thread: Re: Time lag issue of forwarding vs available I/O at 6600 mp - (Mode 'reply')

[noreply at adiscon.com]

User: dlang 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=26781#p26781

Message: 
----------
what version of rsyslog in on the central server?

unless the queue was filling up and therefor radosgw was waiting on
/dev/log, I don't understand what you are talking about when you say that
I/O was being eaten up by rsyslog, or how changing the queue would affect
that (adding a DA queue would cause more I/O)

what is it that you are seeing in the pstats output? what is it that's not
processing the logs fast enough?

adding lots of worker threads can actually slow things down drastically, I
think you need to go back to square 1 and see what the problem is.

I would also suggest that for any action where you want a queue, use the
action() format it makes it clear what has a queue and what doesn't

With a single worker thread and default queue settings,  what is impstats
showing on the client?

If it is showing that the bottleneck in on the delivery to the server, what
does impstats look like there?

we would need to see more of the config on the server to have any idea what
it's actually doing and figure out where the bottlenecks could be.

it may also be helpful to look at top and go to the per-thread view (hit
'H') and see what rsyslog thread is maxing out a cpu.

David Lang