Bug #3604
closed
When using rsyslog with a version > 5.7.1 on the server, some reports may be dropped, leading to NoAnswer on the server
Added by Nicolas CHARLES over 11 years ago.
Updated over 9 years ago.
Description
Rsyslog introduced a "rate limiting" feature in rsyslog 5.7.1 ( http://www.rsyslog.com/tag/rate-limiting/ )
So we can face log message like
imuxsock begins to drop messages from pid 30351 due to rate-limiting
along with incomplete reporting on the server.
A workaround ( ref http://www.gossamer-threads.com/lists/rsyslog/users/8513 ) is to add the config
$SystemLogRateLimitInterval 0
However, this should be added only for version that support it (I guess 5.7.1, but I couldn't find where it was introduced)
- Status changed from New to In progress
- Assignee set to Nicolas PERRON
Nicolas CHARLES wrote:
[...]
However, this should be added only for version that support it (I guess 5.7.1, but I couldn't find where it was introduced)
Ok, I will search for the right version before to add a workaround
The changelog of rsyslog does not indicate when imuxsock module has been added (it seems to exist since the first versions) but the parameter to workaround this bug has been added since 5.7.1:
From http://www.rsyslog.com/changelog-for-5-7-1-v5-devel/ :
added new config statements
$InputUnixListenSocketUsePIDFromSystem
$SystemLogUsePIDFromSystem
$SystemLogRateLimitInterval
[...]
I'm not sure on how to check the version of rsyslog with CFEngine.
On shell these commands are OK:
rpm -qi rsyslog | grep 'Version' | awk '{print $3}'
dpkg -l | grep 'rsyslog ' | awk '{print $3}'
dpkg -s rsyslog | grep 'Version' | awk '{print $2}'
But I don't see how to ensure that they are not more recent than 5.7.1
Another solution could be to check the OS version and Service Pack since rsyslog in a OS version or Service Pack should not make major upgrade.
Another method suggested by Nicolas is to use CFEngine to install rsyslog =< 5.7.1 in WarnOnly to throw classes and use them to add the configuration in rsyslog or not.
Nicolas PERRON wrote:
Another method suggested by Nicolas is to use CFEngine to install rsyslog =< 5.7.1 in WarnOnly to throw classes and use them to add the configuration in rsyslog or not.
WarnOnly doesn't seem to work with packages promises... Then I will make a module instead.
- % Done changed from 0 to 10
A module containing something like:
#!/bin/bash
set -e
TARGET_VER='5.7.1'
LOCAL_RPM_VER=`rpm -qi rsyslog | grep 'Version' | awk '{print $3}'`
LOCAL_DPKG_VER=`dpkg -s rsyslog | grep 'Version' | awk '{print $2}'`
for LOCAL_VER in $LOCAL_RPM_VER $LOCAL_DPKG_VER
do
if [ "$LOCAL_VER" \> "$TARGET_VER" ];then
echo "+rsyslog_not_older_than_5_7_1"
else
echo "+rsyslog_older_than_5_7_1"
fi
done
Should be called to know if the configuration line has to be added.
- Status changed from In progress to Pending technical review
- Assignee changed from Nicolas PERRON to Jonathan CLARKE
- % Done changed from 10 to 100
- Pull Request set to https://github.com/Normation/rudder-techniques/pull/133
- Status changed from Pending technical review to Pending release
Applied in changeset commit:b4a2d5a0a20a07b853b012bc2dea6408f23b7800.
Applied in changeset commit:a1d1443d6e71d712761be7fb4edc360ded14a42f.
- Status changed from Pending release to Released
- Project changed from 24 to Rudder
- Category changed from Techniques to Techniques
Also available in: Atom
PDF
Updated by Nicolas PERRON 
Updated by Jonathan CLARKE 
Updated by