[rsyslog] Disabling Rate Limiting

[Justin Brown]

Hello,

I'm having quite a bit of trouble globally disabling rate limiting.

My rsyslog.conf is attached, and I'm using rsyslogd 5.8.10 (CentOS 6).

I created a rsyslog debug log and attached it as a tar.gz.

Command:
rsyslogd -c5 -f /etc/rsyslog.conf -dn | tee -a /tmp/rsyslog.debug

I see the following message in /var/log/messages from much earlier. I
configured two parameters (listed below), and I have not seen any drop
messages since.

Jan 22 13:21:12 dc2opsdashqa01 rsyslogd-2177: imuxsock begins to drop
messages from pid 18197 due to rate-limiting

I thought that the following parameters would completely disable rate
limiting, but it appears that I was wrong.

# Disable rate limiting.
$IMUXSockRateLimitInterval 0
$SystemLogRateLimitInterval 0

My problem is that I'm sending lots of messages to the local5 facility, but
at some point, all the messages start appearing in /var/log/messages.

Could someone help me completely disable rate limiting?

I haven't been able to make much sense of
http://www.rsyslog.com/doc/imuxsock.html.

Sincerely,
Justin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: rsyslog.conf
Type: application/octet-stream
Size: 1890 bytes
Desc: not available
URL: <http://lists.adiscon.net/pipermail/rsyslog/attachments/20130122/bc98823d/attachment-0001.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: rsyslog.debug.tar.gz
Type: application/x-gzip
Size: 188774 bytes
Desc: not available
URL: <http://lists.adiscon.net/pipermail/rsyslog/attachments/20130122/bc98823d/attachment-0001.bin>

[David Lang]

I am not understanding your problem.

If rate limiting is on, you end up throwing away logs, if it is off you don't
throw away any logs.

nothing about rate limiting would change where the logs show up.

David Lang

Post by Justin Brown
Hello,
I'm having quite a bit of trouble globally disabling rate limiting.
My rsyslog.conf is attached, and I'm using rsyslogd 5.8.10 (CentOS 6).
I created a rsyslog debug log and attached it as a tar.gz.
rsyslogd -c5 -f /etc/rsyslog.conf -dn | tee -a /tmp/rsyslog.debug
I see the following message in /var/log/messages from much earlier. I
configured two parameters (listed below), and I have not seen any drop
messages since.
Jan 22 13:21:12 dc2opsdashqa01 rsyslogd-2177: imuxsock begins to drop
messages from pid 18197 due to rate-limiting
I thought that the following parameters would completely disable rate
limiting, but it appears that I was wrong.
# Disable rate limiting.
$IMUXSockRateLimitInterval 0
$SystemLogRateLimitInterval 0
My problem is that I'm sending lots of messages to the local5 facility, but
at some point, all the messages start appearing in /var/log/messages.
Could someone help me completely disable rate limiting?
I haven't been able to make much sense of
http://www.rsyslog.com/doc/imuxsock.html.
Sincerely,
Justin

-------------- next part --------------
A non-text attachment was scrubbed...
Name: rsyslog.conf
Type: application/octet-stream
Size: 1890 bytes
Desc:
URL: <http://lists.adiscon.net/pipermail/rsyslog/attachments/20130122/d2e5484e/attachment.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: rsyslog.debug.tar.gz
Type: application/x-gzip
Size: 188774 bytes
Desc:
URL: <http://lists.adiscon.net/pipermail/rsyslog/attachments/20130122/d2e5484e/attachment.bin>
-------------- next part --------------
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

[Justin Brown]

David,

Thanks for the response. After some deeper reflection, I think this may be
a PEBKAC problem.

All of the messages in /var/log/messages have a severity of INFO.

rsyslog.conf:
...
*.info;mail.none;authpriv.none;cron.none /var/log/messages
...
local5.* -/var/log/local5.log

Well duh! *.info goes to /var/log/messages as well as /var/log/local5.log.

It's not rate limiting; it's me not understanding rsyslog.

(All of the messages were still showing up in /var/log/local5.log and

=INFO were also going to /var/log/messages.)

What I want to do is leave the rate limiting stuff in place:
$IMUXSockRateLimitInterval 0
$SystemLogRateLimitInterval 0

and modify the /var/log/messages line to

*.info;*local5.none;*mail.none;authpriv.none;cron.none
/var/log/messages

(And I would repeat for other local facilities as needed.)

Anyways, thanks for the response.

Cheers,
Justin

I am not understanding your problem.
If rate limiting is on, you end up throwing away logs, if it is off you
don't throw away any logs.
nothing about rate limiting would change where the logs show up.
David Lang
Hello,

Post by Justin Brown
I'm having quite a bit of trouble globally disabling rate limiting.
My rsyslog.conf is attached, and I'm using rsyslogd 5.8.10 (CentOS 6).
I created a rsyslog debug log and attached it as a tar.gz.
rsyslogd -c5 -f /etc/rsyslog.conf -dn | tee -a /tmp/rsyslog.debug
I see the following message in /var/log/messages from much earlier. I
configured two parameters (listed below), and I have not seen any drop
messages since.
Jan 22 13:21:12 dc2opsdashqa01 rsyslogd-2177: imuxsock begins to drop
messages from pid 18197 due to rate-limiting
I thought that the following parameters would completely disable rate
limiting, but it appears that I was wrong.
# Disable rate limiting.
$IMUXSockRateLimitInterval 0
$SystemLogRateLimitInterval 0
My problem is that I'm sending lots of messages to the local5 facility, but
at some point, all the messages start appearing in /var/log/messages.
Could someone help me completely disable rate limiting?
I haven't been able to make much sense of
http://www.rsyslog.com/doc/**imuxsock.html<http://www.rsyslog.com/doc/imuxsock.html>
.
Sincerely,
Justin

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.