問題:
今天遇到一個syslog間歇性缺失的問題,排查了一圈發現是限速導致的。
cat /var/log/message | grep rate-limit
有如下信息:
Feb 9 10:22:32 localhost rsyslogd: imuxsock lost 432 messages from pid 9832 due to rate-limiting
解決:
1.修改配置文件
對於centos6,修改/etc/rsyslog.conf新增
$SystemLogRateLimitInterval 0
$SystemLogRateLimitBurst 0
$IMUxSockRateLimitBurst 0
$IMUXSockRateLimitInterval 0
$IMUxSockRateLimitSeverity 7
對於centos7,修改/etc/rsyslog.conf新增
$SystemLogRateLimitInterval 0
$SystemLogRateLimitBurst 0
# 在$ModLoad imjournal之后新增
$ImjournalRateLimitInterval 0
修改:/etc/systemd/journald.conf
注釋掉:
RateLimitInterval=5s
RateLimitBurst=30000
2.重啟服務
systemctl restart systemd-journald
systemctl restart rsyslog
參考資料
https://www.thegeekdiary.com/imuxsock-lost-messages-from-pid-due-to-rate-limiting-rsyslog-rate-limiting-in-linux/
https://www.rsyslog.com/how-to-use-rate-limiting-in-rsyslog/