rsyslog forwarding log very slowly

Question

I configured rsyslog that forwards some logs to logstash via udp port. I am sending alot of events to rsyslog. Rsyslog properly gets all of events to queue. But Rsyslog is sending the events to logstash very slowly

logstash gets approximately 50 - 100 events every 30 -40 seconds. Not sending immediately or continuously.

I configured rsyslog conf that is sending events to a file. Also, I created ram disk for sending the events to avoid disk-i/o performance problem.

Result is same. Rsyslog has alot of events(5000-10000) in main queue, is sending approximately 30-40 events every 20-30 seconds

Rsyslog version is 8.21

Where is problem in my config

Rsyslog.conf:

module(load="imudp")
input(type="imudp" port="5550" ruleset="rs1")

module(
  load="impstats"
  interval="5"             # how often to generate stats
  resetCounters="on"        # to get deltas (e.g. # of messages submitted in the last 10 seconds)
  log.file="/tmp/stats"     # file to write those stats to
  log.syslog="off"          # don't send stats through the normal processing pipeline. More on that in a bit
)

main_queue(
  queue.type="LinkedList"
  queue.workerthreads="4"
  queue.dequeueBatchSize="100" 
  queue.size="10000"           
)   

ruleset(name="rs1") {

    action(type="omfwd" Target="localhost" Port="5570" Protocol="udp")
    #action(type="omfile" dirCreateMode="0777" FileCreateMode="0777" File="/run/shm/messages"
}

rsyslog forwarding log very slowly

0 Answers0