MonitorWare Knowledge Base

Now that I have my logs flowing, I'm seeing something very strange.

The logs entries come in about 1 per second on the receiving end.

Because of this, my logs rapidly get minutes behind the sending host. I rebooted the sending host, and by the time it logged the shutdown messages I had fully rebooted, and then those messages started coming in.

Is there a queue somewhere that I can tweak?

I should mention that I have about 8 Mbps of UDP multicast traffic on the LAN that the messages are on as well, although none of them are missing, they are very slow. I am on port 514 for the messages.

-Jeff

• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

I barely remember there was an issue in some cases. Could you try out the latest release?

I am up to date from the debian repo, do you mean pull from unstable or build from source?

-Jeff

there should be a new package for Debian from the maintainer. Due to 5.0 freeze, we were forced to use a somewhat older version of v3-stable. AFIK the maintainer has made available 3.20.x right now. As I said, I think I remember one case where we had strange performance issues. It had to do with IPv6, I think, but I have to admit I am not sure this was in v3 or v4...

Is just the reception slow or are messages slowly emitted?

side-note: I just created a rough version chart, maybe useful: http://blog.gerhards.net/2009/03/rsyslo ... -tree.html

It has to be the write out to the log, since I go through power cycles and the log entries for the shut down don't appear until after the power is off on the send side.

-Jeff

Just a follow up for all others: the issue was DNS resolution where no reverse DNS was available. Disabling reverse lookups (-x) fixed the issue.