[rsyslog-notify] Forum Thread: Re: Time lag issue of forwarding vs available I/O at 6600 mp - (Mode 'reply')

[noreply at adiscon.com]

User: rajatg 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=26793#p26793

Message: 
----------
Hi,

Following is the config on the central server.

[code:152c8ndg]
 $ModLoad imuxsock # provides support for local system logging
    $ModLoad imklog   # provides kernel logging support
    $ModLoad imtcp
    $InputTCPServerRun 514
    $KLogPermitNonKernelFacility on
    $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
    $RepeatedMsgReduction on
    $FileOwner syslog
    $FileGroup adm
    $FileCreateMode 0640
    $DirCreateMode 0755
    $Umask 0022
    $PrivDropToUser syslog
    $PrivDropToGroup syslog
    $WorkDirectory /var/spool/rsyslog

$IncludeConfig /etc/rsyslog.d/*.conf

:msg, contains, "DSS API LOGGING"
*.* /var/log/api.log
$template FILENAME,"/var/log/main_syslog.log"
*.* ?FILENAME
#:msg, contains, "irq" then /var/log/filtered_rsyslog.log
:msg, contains, "irq" stop
:msg, contains, "COMMAND=/bin/grep" stop
*.* /var/log/filtered_rsyslog.log

[/code:152c8ndg]   

Now, I have upgraded the rsyslog to 8.19.0 both on client and server. But,
I am still seeing the above issue. No thread on server goes to 100%, rather
the main queue thread stays within 12%.
However, one more option to send the logs is to use the module imfile,
which I also tried in 7.4.4. But I faced the issue mentioned in the post
<!-- l --><a class="postlink-local"
href="http://kb.monitorware.com/post26792.html#p26792">post26792.html#p26792</a><!--
l --> very frequently. But, when I upgraded to 8.19.0, although, it works
for most of the time, but sometimes faces the same issue (faced very less
frequently), and thus the logs are dumped only after the restart of
rsyslog.
You can find the imfile configuration in the last reply to the imfile post.
Let me know if you can help in any of the two approaches.

Thanks,
Rajat