One of my sites runs extremely slow,
and I use top command to see that "rsyslogd" cost 170M memory,
is that normal?
If not,how can I limit the size of memory "rsyslogd" cost,or the frequency the "rsyslogd"
runs?
Asked
Active
Viewed 5,750 times
5
-
Someone here might know, but you'd probably have more luck over on serverfault.com – Eric Petroelje May 26 '09 at 19:13
-
got same problem like you. My rsyslogd cost more than 170M, about 200M – Gohan Mar 25 '14 at 09:46
3 Answers
3
Yes and No. Generally you are using file/disk queue mode. It caches the writes to a buffer and writes out a block at time instead of an inefficent line by line at a time with open and close; reducing unnecessary and small disk accesses.
The problem lies in the fact that it makes a 10MB buffer for every file its logging. 20 log files means 200+MB. The number of log files can always be reduced, but it also possible to reduce the buffer size if you are not running a raid (big-block) or hi-demand system. The documentation is here: http://www.rsyslog.com/doc/v8-stable/concepts/queues.html#disk-queues , ”$<object>QueueMaxFileSize” to reduce the size of each buffer. 4MB can cut you down to 70MB
ppostma1
- 3,616
- 1
- 27
- 28
2
Sounds like you've got some process logging way too much info. You might just look at the logs and see who's doing all the writing and see if you can get them to stop. I've seen logs hit gigabyte sizes when some program has a recurring fault that causes it to log the same error message thousands of times a second. Seriously check the logs and just see who the heck is hammering rsyslogd.
Robert S. Barnes
- 39,711
- 30
- 131
- 179
1
There can be no 'frequency the "rsyslogd" runs', because it is a daemon, providing logging facilities. As Robert S.Barnes indicated, you'd better check the logs to determine the application, that is clogging up rsyslogd (ha!). The names of the logs are OS-specific, but chances are, they are in /var/log and its subdirectories. I've seen rsyslogd consume relatively large amounts of memory, but 170Mb is wayyyyyy too much and is not normal at all.
Shameless offtopic edit: I have serverfault and stackoverflow tabs next to each other and, honestly, I was 100% sure I was posting to serverfault until I've actually submitted the answer (that should be a hint for you) :P
shylent
- 10,076
- 6
- 38
- 55