1

I am using rsyslog v5.8.11. I found this version number from what rsyslog logs on restart. I am trying to apply rate-limiting in rsyslog but it is of no use. I am still losing messages. In the configuration file I put these options to implement rate-limiting

$SystemLogRateLimitInterval 5
$SystemLogRateLimitBurst 10000

This is of no use as I am still losing messages at the same rate. I even tried to put

$SystemLogRateLimitInterval 0

This should have stopped the rate-limiting feature of rsyslog but instead nothing happened. I am still losing message. These logs are critical to me. Is there any way possible to stop losing messages in rsyslog.

UPDATE

On restart i also found this in rsyslog logs.

rsyslogd: invalid selector line (port), probably not doing what was intended

Is losing logs somehow related to this error.

There are the logs showing that i am losing logs due to rate-limiting.

rsyslogd-2177: imuxsock begins to drop messages from pid 25810 due to rate-limiting
rsyslogd-2177: imuxsock lost 103 messages from pid 25810 due to rate-limiting

Such type of logs are coming no matter what setting is applied by me. If logs are lost due to UDP will rsyslog log in this manner too?

| improve this question | |
  • These messages that you're losing: are they being delivered by the network, or generated locally? If they're over the network and you're using UDP then there's no guarantee that they'll even get delivered, so it might not be rsyslog that is dropping them. You would need to configure the reliable delivery component of rsyslog and run rsyslog on all your message generators. – roaima May 6 '15 at 14:06
  • Messages are generated locally. But final storage of these messages are on different server and there i am seeing lost messages in logs. I am updating my original question with the logs which i am getting thus showing me lost messages. – shivams May 6 '15 at 14:09
  • OK. Same question but asked differently then. How close to the source of the messages are you finding messages are being lost? If messages are being stored on a different server are you delivering messages across the network connection using the reliable delivery feature of rsyslog? – roaima May 6 '15 at 14:11
  • I am reading logs using imuxsock over unix sockets on local machine and then those logs are send to another machine using omrelp. Also please see my update in question which contain logs showing that logs are lost due to rate limiting. – shivams May 6 '15 at 14:15
5

You are probably using debian wheezy, as rsyslog v5.8.11 is used by this debian release.

Upgrade to debian jeesie or install rsyslog from debian-backports to fix this.

The wheezy rsyslog have a bug that will not disable the rate limit, but the new version will read the config and (finally) disable the rate limit.

| improve this answer | |
  • 1
    you still need to use the $SystemLogRateLimitInterval 0 or similar, but at least now it should be applied – higuita Aug 5 '15 at 16:50
2

If you're reading logs from an imuxsock input, then rate-limiting is not affected by $SystemLogRateLimitInterval.

You have to use:

$IMUXSockRateLimitInterval x
$IMUXSockRateLimitBurst y
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.