Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

On a pretty high traffic web site running in virtual containers (VMware) and lacking local storage, we've managed to increase throughput (requests per second) significantly by switching from logging directly into log-files (which reside on remote network storage) to rsyslogd.

Essentially we've switched from synchronous to asynchronous logging. The web server workers write using syslog(3) to some memory buffer and rsyslogd(8) sends the data to an actual file in parallel, and at its own pace, so processes don't block on IO when logging.

So far so good. The problem is that ocassionally rsyslogd is prevented from writing (e.g. a momentary/prolonged network outage) and the incoming buffer quickly fills up.

My questions are:

  • Can a client ever block when writing to rsyslogd using syslog(3)?
  • Is there a way to look at rsyslogd stats, e.g. how big/full is the buffer?
  • Is there a way to increase the size of the rsyslogd incoming buffer?
share|improve this question
Did you ever solve this? If so, I'd be interested in reading your answer. –  djeikyb Dec 31 '13 at 17:21
@djeikyb: sorry no. I see interest (votes on the question) but no one has answered it yet. Looks like this requires a source-code dive. –  arielf Jan 1 at 9:24
add comment

1 Answer

As far as I remember the default mode for the main message queue in rsyslog is fixed size array. It has a limit for 10k elements or so. Try to change this to linked list queue it should handle your occasional message bursts much better.

Yes, there are FixedArray and LinkedList queues.

share|improve this answer
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.