Discussion:
[rsyslog] Does rsyslog use ephemeral ports?
Boylan, James
2013-05-14 13:25:16 UTC
Permalink
Greetings!

I'm trying to get a better idea on the number of connections a single Rsyslog server can support. I currently have it running in our pre-production environment as a smoke test for performance, but I want to check on this prior to moving it into our production environment.

Does it use ephemeral ports or is it using a static port with a finite amount of load it can handle?

Thanks!

--James
David Lang
2013-05-14 12:30:42 UTC
Permalink
Post by Boylan, James
Greetings!
I'm trying to get a better idea on the number of connections a single Rsyslog server can support. I currently have it running in our pre-production environment as a smoke test for performance, but I want to check on this prior to moving it into our production environment.
Does it use ephemeral ports or is it using a static port with a finite amount of load it can handle?
It uses ephemeral ports as the source for outbound connections, the way just
about everything does.

It uses fixed ports for inbound connections, the way just about everything does.

people have reported rsyslog handling 1M logs/sec, and this is not limited by
the network ports. What are you referring to when you say "a static port with a
finite amount of load it can handle"?

David Lang
Boylan, James
2013-05-14 13:38:10 UTC
Permalink
I'm investigating issues with the current syslog server that is running in our environment. The information I had found was they were running into issues with the instances reaching a connection limit on the port that resulted in them running multiple instances.

I'm beginning to suspect it had more to do with how the connections were being managed than a set limit of how many connections were being able to be supported by the specific fixed port.

Thanks David. Based on the performance I've been seeing with Rsyslog, the fact that is also uses a fixed port supports my theory.

-- James

-----Original Message-----
From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog-bounces at lists.adiscon.com] On Behalf Of David Lang
Sent: Tuesday, May 14, 2013 7:31 AM
To: rsyslog-users
Subject: Re: [rsyslog] Does rsyslog use ephemeral ports?
Post by Boylan, James
Greetings!
I'm trying to get a better idea on the number of connections a single Rsyslog server can support. I currently have it running in our pre-production environment as a smoke test for performance, but I want to check on this prior to moving it into our production environment.
Does it use ephemeral ports or is it using a static port with a finite amount of load it can handle?
It uses ephemeral ports as the source for outbound connections, the way just about everything does.

It uses fixed ports for inbound connections, the way just about everything does.

people have reported rsyslog handling 1M logs/sec, and this is not limited by the network ports. What are you referring to when you say "a static port with a finite amount of load it can handle"?

David Lang
Rainer Gerhards
2013-05-14 13:45:08 UTC
Permalink
If you don't need TLS, I recommend imptcp as an input. It handles even
larger loads and uses less CPU (but is linux specific).

Rainer
Post by Boylan, James
I'm investigating issues with the current syslog server that is running in
our environment. The information I had found was they were running into
issues with the instances reaching a connection limit on the port that
resulted in them running multiple instances.
I'm beginning to suspect it had more to do with how the connections were
being managed than a set limit of how many connections were being able to
be supported by the specific fixed port.
Thanks David. Based on the performance I've been seeing with Rsyslog, the
fact that is also uses a fixed port supports my theory.
-- James
-----Original Message-----
rsyslog-bounces at lists.adiscon.com] On Behalf Of David Lang
Sent: Tuesday, May 14, 2013 7:31 AM
To: rsyslog-users
Subject: Re: [rsyslog] Does rsyslog use ephemeral ports?
Post by Boylan, James
Greetings!
I'm trying to get a better idea on the number of connections a single
Rsyslog server can support. I currently have it running in our
pre-production environment as a smoke test for performance, but I want to
check on this prior to moving it into our production environment.
Post by Boylan, James
Does it use ephemeral ports or is it using a static port with a finite
amount of load it can handle?
It uses ephemeral ports as the source for outbound connections, the way
just about everything does.
It uses fixed ports for inbound connections, the way just about everything does.
people have reported rsyslog handling 1M logs/sec, and this is not limited
by the network ports. What are you referring to when you say "a static port
with a finite amount of load it can handle"?
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites
beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
Boylan, James
2013-05-14 13:47:14 UTC
Permalink
We'll definitely be using imtcp in the short term, though we are considering imrhelp in the long term.

-- James

-----Original Message-----
From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog-bounces at lists.adiscon.com] On Behalf Of Rainer Gerhards
Sent: Tuesday, May 14, 2013 8:45 AM
To: rsyslog-users
Subject: Re: [rsyslog] Does rsyslog use ephemeral ports?

If you don't need TLS, I recommend imptcp as an input. It handles even larger loads and uses less CPU (but is linux specific).

Rainer
Post by Boylan, James
I'm investigating issues with the current syslog server that is
running in our environment. The information I had found was they were
running into issues with the instances reaching a connection limit on
the port that resulted in them running multiple instances.
I'm beginning to suspect it had more to do with how the connections
were being managed than a set limit of how many connections were being
able to be supported by the specific fixed port.
Thanks David. Based on the performance I've been seeing with Rsyslog,
the fact that is also uses a fixed port supports my theory.
-- James
-----Original Message-----
rsyslog-bounces at lists.adiscon.com] On Behalf Of David Lang
Sent: Tuesday, May 14, 2013 7:31 AM
To: rsyslog-users
Subject: Re: [rsyslog] Does rsyslog use ephemeral ports?
Post by Boylan, James
Greetings!
I'm trying to get a better idea on the number of connections a single
Rsyslog server can support. I currently have it running in our
pre-production environment as a smoke test for performance, but I
want to check on this prior to moving it into our production environment.
Post by Boylan, James
Does it use ephemeral ports or is it using a static port with a finite
amount of load it can handle?
It uses ephemeral ports as the source for outbound connections, the
way just about everything does.
It uses fixed ports for inbound connections, the way just about everything does.
people have reported rsyslog handling 1M logs/sec, and this is not
limited by the network ports. What are you referring to when you say
"a static port with a finite amount of load it can handle"?
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites
beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE
WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
Rainer Gerhards
2013-05-14 13:50:34 UTC
Permalink
im*p*tcp I said, not imtcp ;)
Post by Boylan, James
We'll definitely be using imtcp in the short term, though we are
considering imrhelp in the long term.
-- James
-----Original Message-----
rsyslog-bounces at lists.adiscon.com] On Behalf Of Rainer Gerhards
Sent: Tuesday, May 14, 2013 8:45 AM
To: rsyslog-users
Subject: Re: [rsyslog] Does rsyslog use ephemeral ports?
If you don't need TLS, I recommend imptcp as an input. It handles even
larger loads and uses less CPU (but is linux specific).
Rainer
On Tue, May 14, 2013 at 3:38 PM, Boylan, James <JAMES.BOYLAN at orbitz.com
Post by Boylan, James
I'm investigating issues with the current syslog server that is
running in our environment. The information I had found was they were
running into issues with the instances reaching a connection limit on
the port that resulted in them running multiple instances.
I'm beginning to suspect it had more to do with how the connections
were being managed than a set limit of how many connections were being
able to be supported by the specific fixed port.
Thanks David. Based on the performance I've been seeing with Rsyslog,
the fact that is also uses a fixed port supports my theory.
-- James
-----Original Message-----
rsyslog-bounces at lists.adiscon.com] On Behalf Of David Lang
Sent: Tuesday, May 14, 2013 7:31 AM
To: rsyslog-users
Subject: Re: [rsyslog] Does rsyslog use ephemeral ports?
Post by Boylan, James
Greetings!
I'm trying to get a better idea on the number of connections a single
Rsyslog server can support. I currently have it running in our
pre-production environment as a smoke test for performance, but I
want to check on this prior to moving it into our production environment.
Post by Boylan, James
Does it use ephemeral ports or is it using a static port with a finite
amount of load it can handle?
It uses ephemeral ports as the source for outbound connections, the
way just about everything does.
It uses fixed ports for inbound connections, the way just about everything does.
people have reported rsyslog handling 1M logs/sec, and this is not
limited by the network ports. What are you referring to when you say
"a static port with a finite amount of load it can handle"?
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites
beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE
WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites
beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
Boylan, James
2013-05-14 13:53:33 UTC
Permalink
Oh! I missed the P.

I'll have to look into that. Our log servers are handling considerably more than 1mb/sec so I'm going to have to figure out a means of testing this overall performance. David was saying that he had heard of people sending 1mb/sec using imtcp. Do we have any estimates on what imptcp could handle?

-- James


-----Original Message-----
From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog-bounces at lists.adiscon.com] On Behalf Of Rainer Gerhards
Sent: Tuesday, May 14, 2013 8:51 AM
To: rsyslog-users
Subject: Re: [rsyslog] Does rsyslog use ephemeral ports?

im*p*tcp I said, not imtcp ;)
Post by Boylan, James
We'll definitely be using imtcp in the short term, though we are
considering imrhelp in the long term.
-- James
-----Original Message-----
rsyslog-bounces at lists.adiscon.com] On Behalf Of Rainer Gerhards
Sent: Tuesday, May 14, 2013 8:45 AM
To: rsyslog-users
Subject: Re: [rsyslog] Does rsyslog use ephemeral ports?
If you don't need TLS, I recommend imptcp as an input. It handles even
larger loads and uses less CPU (but is linux specific).
Rainer
On Tue, May 14, 2013 at 3:38 PM, Boylan, James
<JAMES.BOYLAN at orbitz.com
Post by Boylan, James
I'm investigating issues with the current syslog server that is
running in our environment. The information I had found was they
were running into issues with the instances reaching a connection
limit on the port that resulted in them running multiple instances.
I'm beginning to suspect it had more to do with how the connections
were being managed than a set limit of how many connections were
being able to be supported by the specific fixed port.
Thanks David. Based on the performance I've been seeing with
Rsyslog, the fact that is also uses a fixed port supports my theory.
-- James
-----Original Message-----
rsyslog-bounces at lists.adiscon.com] On Behalf Of David Lang
Sent: Tuesday, May 14, 2013 7:31 AM
To: rsyslog-users
Subject: Re: [rsyslog] Does rsyslog use ephemeral ports?
Post by Boylan, James
Greetings!
I'm trying to get a better idea on the number of connections a single
Rsyslog server can support. I currently have it running in our
pre-production environment as a smoke test for performance, but I
want to check on this prior to moving it into our production environment.
Post by Boylan, James
Does it use ephemeral ports or is it using a static port with a finite
amount of load it can handle?
It uses ephemeral ports as the source for outbound connections, the
way just about everything does.
It uses fixed ports for inbound connections, the way just about everything does.
people have reported rsyslog handling 1M logs/sec, and this is not
limited by the network ports. What are you referring to when you say
"a static port with a finite amount of load it can handle"?
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE
WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if
you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites
beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE
WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
Rainer Gerhards
2013-05-14 13:55:52 UTC
Permalink
1M *logs* per second, not mb ;)
Post by Boylan, James
Oh! I missed the P.
I'll have to look into that. Our log servers are handling considerably
more than 1mb/sec so I'm going to have to figure out a means of testing
this overall performance. David was saying that he had heard of people
sending 1mb/sec using imtcp. Do we have any estimates on what imptcp could
handle?
-- James
-----Original Message-----
rsyslog-bounces at lists.adiscon.com] On Behalf Of Rainer Gerhards
Sent: Tuesday, May 14, 2013 8:51 AM
To: rsyslog-users
Subject: Re: [rsyslog] Does rsyslog use ephemeral ports?
im*p*tcp I said, not imtcp ;)
On Tue, May 14, 2013 at 3:47 PM, Boylan, James <JAMES.BOYLAN at orbitz.com
Post by Boylan, James
We'll definitely be using imtcp in the short term, though we are
considering imrhelp in the long term.
-- James
-----Original Message-----
rsyslog-bounces at lists.adiscon.com] On Behalf Of Rainer Gerhards
Sent: Tuesday, May 14, 2013 8:45 AM
To: rsyslog-users
Subject: Re: [rsyslog] Does rsyslog use ephemeral ports?
If you don't need TLS, I recommend imptcp as an input. It handles even
larger loads and uses less CPU (but is linux specific).
Rainer
On Tue, May 14, 2013 at 3:38 PM, Boylan, James
<JAMES.BOYLAN at orbitz.com
Post by Boylan, James
I'm investigating issues with the current syslog server that is
running in our environment. The information I had found was they
were running into issues with the instances reaching a connection
limit on the port that resulted in them running multiple instances.
I'm beginning to suspect it had more to do with how the connections
were being managed than a set limit of how many connections were
being able to be supported by the specific fixed port.
Thanks David. Based on the performance I've been seeing with
Rsyslog, the fact that is also uses a fixed port supports my theory.
-- James
-----Original Message-----
rsyslog-bounces at lists.adiscon.com] On Behalf Of David Lang
Sent: Tuesday, May 14, 2013 7:31 AM
To: rsyslog-users
Subject: Re: [rsyslog] Does rsyslog use ephemeral ports?
Post by Boylan, James
Greetings!
I'm trying to get a better idea on the number of connections a single
Rsyslog server can support. I currently have it running in our
pre-production environment as a smoke test for performance, but I
want to check on this prior to moving it into our production
environment.
Post by Boylan, James
Post by Boylan, James
Post by Boylan, James
Does it use ephemeral ports or is it using a static port with a finite
amount of load it can handle?
It uses ephemeral ports as the source for outbound connections, the
way just about everything does.
It uses fixed ports for inbound connections, the way just about everything does.
people have reported rsyslog handling 1M logs/sec, and this is not
limited by the network ports. What are you referring to when you say
"a static port with a finite amount of load it can handle"?
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE
This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE
WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if
you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites
beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE
WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites
beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
David Lang
2013-05-14 12:56:22 UTC
Permalink
Post by Boylan, James
Oh! I missed the P.
I'll have to look into that. Our log servers are handling considerably more
than 1mb/sec so I'm going to have to figure out a means of testing this
overall performance. David was saying that he had heard of people sending
1mb/sec using imtcp. Do we have any estimates on what imptcp could handle?
not 1MB/sec, 1M messages/sec several hundred times more traffic

I've maxed out Gig-E with rsyslog at 380K messages/sec and other people with
10Gig-E have reported getting to 1 million messages per second.

David Lang
Post by Boylan, James
-- James
-----Original Message-----
From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog-bounces at lists.adiscon.com] On Behalf Of Rainer Gerhards
Sent: Tuesday, May 14, 2013 8:51 AM
To: rsyslog-users
Subject: Re: [rsyslog] Does rsyslog use ephemeral ports?
im*p*tcp I said, not imtcp ;)
Post by Boylan, James
We'll definitely be using imtcp in the short term, though we are
considering imrhelp in the long term.
-- James
-----Original Message-----
rsyslog-bounces at lists.adiscon.com] On Behalf Of Rainer Gerhards
Sent: Tuesday, May 14, 2013 8:45 AM
To: rsyslog-users
Subject: Re: [rsyslog] Does rsyslog use ephemeral ports?
If you don't need TLS, I recommend imptcp as an input. It handles even
larger loads and uses less CPU (but is linux specific).
Rainer
On Tue, May 14, 2013 at 3:38 PM, Boylan, James
<JAMES.BOYLAN at orbitz.com
Post by Boylan, James
I'm investigating issues with the current syslog server that is
running in our environment. The information I had found was they
were running into issues with the instances reaching a connection
limit on the port that resulted in them running multiple instances.
I'm beginning to suspect it had more to do with how the connections
were being managed than a set limit of how many connections were
being able to be supported by the specific fixed port.
Thanks David. Based on the performance I've been seeing with
Rsyslog, the fact that is also uses a fixed port supports my theory.
-- James
-----Original Message-----
rsyslog-bounces at lists.adiscon.com] On Behalf Of David Lang
Sent: Tuesday, May 14, 2013 7:31 AM
To: rsyslog-users
Subject: Re: [rsyslog] Does rsyslog use ephemeral ports?
Post by Boylan, James
Greetings!
I'm trying to get a better idea on the number of connections a single
Rsyslog server can support. I currently have it running in our
pre-production environment as a smoke test for performance, but I
want to check on this prior to moving it into our production environment.
Post by Boylan, James
Does it use ephemeral ports or is it using a static port with a finite
amount of load it can handle?
It uses ephemeral ports as the source for outbound connections, the
way just about everything does.
It uses fixed ports for inbound connections, the way just about everything does.
people have reported rsyslog handling 1M logs/sec, and this is not
limited by the network ports. What are you referring to when you say
"a static port with a finite amount of load it can handle"?
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE
WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if
you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites
beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE
WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Boylan, James
2013-05-14 13:58:46 UTC
Permalink
Ah. I was misreading what you meant by the 1m. Ok. That actually helps considerably.

Thank you very much!

-- James


-----Original Message-----
From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog-bounces at lists.adiscon.com] On Behalf Of David Lang
Sent: Tuesday, May 14, 2013 7:56 AM
To: rsyslog-users
Subject: Re: [rsyslog] Does rsyslog use ephemeral ports?
Post by Boylan, James
Oh! I missed the P.
I'll have to look into that. Our log servers are handling considerably
more than 1mb/sec so I'm going to have to figure out a means of
testing this overall performance. David was saying that he had heard
of people sending 1mb/sec using imtcp. Do we have any estimates on what imptcp could handle?
not 1MB/sec, 1M messages/sec several hundred times more traffic

I've maxed out Gig-E with rsyslog at 380K messages/sec and other people with 10Gig-E have reported getting to 1 million messages per second.

David Lang
Post by Boylan, James
-- James
-----Original Message-----
From: rsyslog-bounces at lists.adiscon.com
[mailto:rsyslog-bounces at lists.adiscon.com] On Behalf Of Rainer
Gerhards
Sent: Tuesday, May 14, 2013 8:51 AM
To: rsyslog-users
Subject: Re: [rsyslog] Does rsyslog use ephemeral ports?
im*p*tcp I said, not imtcp ;)
Post by Boylan, James
We'll definitely be using imtcp in the short term, though we are
considering imrhelp in the long term.
-- James
-----Original Message-----
rsyslog-bounces at lists.adiscon.com] On Behalf Of Rainer Gerhards
Sent: Tuesday, May 14, 2013 8:45 AM
To: rsyslog-users
Subject: Re: [rsyslog] Does rsyslog use ephemeral ports?
If you don't need TLS, I recommend imptcp as an input. It handles
even larger loads and uses less CPU (but is linux specific).
Rainer
On Tue, May 14, 2013 at 3:38 PM, Boylan, James
<JAMES.BOYLAN at orbitz.com
Post by Boylan, James
I'm investigating issues with the current syslog server that is
running in our environment. The information I had found was they
were running into issues with the instances reaching a connection
limit on the port that resulted in them running multiple instances.
I'm beginning to suspect it had more to do with how the connections
were being managed than a set limit of how many connections were
being able to be supported by the specific fixed port.
Thanks David. Based on the performance I've been seeing with
Rsyslog, the fact that is also uses a fixed port supports my theory.
-- James
-----Original Message-----
rsyslog-bounces at lists.adiscon.com] On Behalf Of David Lang
Sent: Tuesday, May 14, 2013 7:31 AM
To: rsyslog-users
Subject: Re: [rsyslog] Does rsyslog use ephemeral ports?
Post by Boylan, James
Greetings!
I'm trying to get a better idea on the number of connections a single
Rsyslog server can support. I currently have it running in our
pre-production environment as a smoke test for performance, but I
want to check on this prior to moving it into our production environment.
Post by Boylan, James
Does it use ephemeral ports or is it using a static port with a finite
amount of load it can handle?
It uses ephemeral ports as the source for outbound connections, the
way just about everything does.
It uses fixed ports for inbound connections, the way just about everything does.
people have reported rsyslog handling 1M logs/sec, and this is not
limited by the network ports. What are you referring to when you say
"a static port with a finite amount of load it can handle"?
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE
WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if
you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE
WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if
you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE
WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
David Lang
2013-05-14 12:54:23 UTC
Permalink
Post by Boylan, James
I'm investigating issues with the current syslog server that is running in our
environment. The information I had found was they were running into issues
with the instances reaching a connection limit on the port that resulted in
them running multiple instances.
a connection limit should only be getting hit if they had a LOT of systems
connecting to them. But even that should be an OS/resource issue that requires
having thousands or tens of thousands of connections to a single system.

David Lang
Post by Boylan, James
I'm beginning to suspect it had more to do with how the connections were being
managed than a set limit of how many connections were being able to be
supported by the specific fixed port.
Thanks David. Based on the performance I've been seeing with Rsyslog, the fact
that is also uses a fixed port supports my theory.
-- James
-----Original Message-----
From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog-bounces at lists.adiscon.com] On Behalf Of David Lang
Sent: Tuesday, May 14, 2013 7:31 AM
To: rsyslog-users
Subject: Re: [rsyslog] Does rsyslog use ephemeral ports?
Post by Boylan, James
Greetings!
I'm trying to get a better idea on the number of connections a single Rsyslog server can support. I currently have it running in our pre-production environment as a smoke test for performance, but I want to check on this prior to moving it into our production environment.
Does it use ephemeral ports or is it using a static port with a finite amount of load it can handle?
It uses ephemeral ports as the source for outbound connections, the way just about everything does.
It uses fixed ports for inbound connections, the way just about everything does.
people have reported rsyslog handling 1M logs/sec, and this is not limited by the network ports. What are you referring to when you say "a static port with a finite amount of load it can handle"?
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Loading...