MonitorWare Knowledge Base

I already tried to install rsyslog in different machines to verify if the nic or the processor is the problem but still the problem exist. First, i've install it in Dell PowerEdge 6850 which the brand of the nic is broadcom, second is ordinary desktop with AMD64 processor and the nic is Intel 1Gigabit and the third one is Supermicro computer 1U with AMD64 processor and NVidia nic. But the problem is still happen. I don't know why this 3 machine has the same result. At first I'm start to install rsyslog version 3.17 but for the sake that there is an updated version, I install rsyslog version 3.20 to verify if the problem solve, but still it doesn't fix.

Any other recommendations you can share us? What version of FreeBSD do i have to install and the steps of installation especially the packages that can't bothered the rsyslog? If so, please let me know.

I really appreciate to help us this thing.

Thank you and more power.

--coroy

• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

ah, ok, that is important info. Actually, could you try out the v2-stable version? (yes, 2.x). The next thing is v4, but v4's udp code is pretty close to v3.

Do you have IPv6 enabled on the system?

Nop, I didn't enabled IPv6 in my system coz the system who's throwing log is not IPv6 enabled. Its a customized application but based also in FreeBSD.

Yes, I install also the v2-stable version from FreeBSD 6.2 ports but still have the problem and other modules that need for me are not in the v2-stable like filtering. That is why I proceed to version 3.17 then, into rsyslog 3.20.2 (v3-stable) released. But still no progress even this v3-stable. Is it rsyslog v4 already ported to FreeBSD latest released? Sorry to ask you this, i know this is not your concern but i need to know if you have an idea.

Hi Rainer,

It's pretty cool in Rsyslog 4.1.3 devel. I've got an improvement in regards to performance. Even though its not one hundred percent i received the log but at least its near in the line.

Thank you very much and more power!

--coroy

maybe the stack is simply overrun... I still wonder why this seems to be related to the default gateway. It makes no sense to me (now even less )... Will keep it on my mind...

HI Rainer,

Given my experiences today, I can say it is highly unlikely it is the IP stack.

I have a single host logging back to a Quad Core system and I'm seeing the one line every second or so problem under UDP but its mostly usable, although still a perceptible delay under TCP.

I have a cluster of 60+ machines at working logging everything back to a single dual core desktop over syslog-ng in a very similar fashion and have never had any issue with the IP stack.

I am going to try and compile from source with the 4x branch and see if it helps me, but there is definitely something odd in the message flow. Also, as I watch the messages come across the wire in near real time with wireshark, I know the PC is getting them.

If you need me to do anything to help, just let me know.

-Jeff

rgerhards wrote:maybe the stack is simply overrun... I still wonder why this seems to be related to the default gateway. It makes no sense to me (now even less )... Will keep it on my mind...

Hi Rainer,

Good day!

After doing several testing on Rsyslog version 4.1.6 comparing to my current Rsyslog server which is version 3.20.5. Now, I'm happy to inform you that the result by benchmarking the current setup to the newer version, i notice that i received bulk of messages from syslog generator . Even though this is not yet stable but still this is the answer from our previous problem. I attached the graph of my comparison between my previous rsyslog installed, to the newer version i have now. The image graph I attached illustrate the size of my file(rsyslog.log). As you've seen the graph in version 3.20.5 it has only 15.7 MB file size of my rsyslog.log while in version 4.1.6 it has 2.1GB file size of my rsyslog.log in just 8 hours bombarding of messages. I'm shock the result because the next problem for me is backing up the logs. Anyway, we've plan to buy a bigger HD for this.

Thanks a lot. Still i'll be doing to monitor and test the new release of your project.

--coroy