Mailing List Archive

There should be documentation included with your distro, look for a -doc
package.

The documentation is maintained in git, so you can clone the repo and go back to
whatever version you want.

We do try to note what version a new feature is added in.

We try REALLY hard to not break existing configs, and even changes to default
values get a lot of debate to make sure they won't break things, and rarely
happen

The community only supports recent releases (although you can get a support
contract with Adiscon for support of other versions)

I don't think there is any throttling by default in rsyslog (although I think
journald/imjournald may have some)

Please post your full config (including included files, starting rsyslog with
the -o /path/to/file option will create a combined file in /path/to/file showing
how rsyslog sees all the configs together)

If you are doing any rate limiting, you should be using the
action()/module()/input() syntax rather than the prior syntax of setting
multiple $foo values then invoking things. The new syntax is much clearer as it
does not depend on side effects of prior statements.

David Lang


On Fri, 1 Sep 2023, Kent Oyer via rsyslog wrote:

> Hi there,
> 1. What is the difference between "SysSock.RateLimit.Interval" and "RateLimit.Interval" as mentioned on https://www.rsyslog.com/doc/v8-stable/configuration/modules/imuxsock.html
> 2. I am running Debian 12 which comes with rsyslogd 8.2102.0. Where is the documentation for this version? I can only find documentation for the latest version (8.2308.0).
> 3. Specifically, I'm trying to find out what the default values are for the rate limiting parameters in version 8.2102.0. It seems that rate limiting used to be enabled by default but it was changed to disabled at some point.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Hi David,
Thanks for the quick response. I was able to download the documentation for my version and confirm that rate limiting is off by default. I'm still not sure what the difference is between "SysSock.RateLimit.Interval" and "RateLimit.Interval" but they both default to 0 so I'm good.
The reason for my confusion was this paragraph in the docs: "The default of 0 has been chosen as people experienced problems with this feature activated by default. Now it needs an explicit opt-in by setting this parameter." The way I read that indicated to me that the default used to be non-zero at some point in the past.
Thanks
Kent
On Fri, Sep 1, 2023 at 04:10 PM, David Lang <david@lang.hm> wrote:
There should be documentation included with your distro, look for a -doc
package.

The documentation is maintained in git, so you can clone the repo and go back to
whatever version you want.

We do try to note what version a new feature is added in.

We try REALLY hard to not break existing configs, and even changes to default
values get a lot of debate to make sure they won't break things, and rarely
happen

The community only supports recent releases (although you can get a support
contract with Adiscon for support of other versions)

I don't think there is any throttling by default in rsyslog (although I think
journald/imjournald may have some)

Please post your full config (including included files, starting rsyslog with
the -o /path/to/file option will create a combined file in /path/to/file showing
how rsyslog sees all the configs together)

If you are doing any rate limiting, you should be using the
action()/module()/input() syntax rather than the prior syntax of setting
multiple $foo values then invoking things. The new syntax is much clearer as it
does not depend on side effects of prior statements.

David Lang

On Fri, 1 Sep 2023, Kent Oyer via rsyslog wrote:

Hi there,
1. What is the difference between "SysSock.RateLimit.Interval" and "RateLimit.Interval" as mentioned on https://www.rsyslog.com/doc/v8-stable/configuration/modules/imuxsock.html (https://www.rsyslog.com/doc/v8-stable/configuration/modules/imuxsock.html)
2. I am running Debian 12 which comes with rsyslogd 8.2102.0. Where is the documentation for this version? I can only find documentation for the latest version (8.2308.0).
3. Specifically, I'm trying to find out what the default values are for the rate limiting parameters in version 8.2102.0. It seems that rate limiting used to be enabled by default but it was changed to disabled at some point.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

It was non-zero at one point, but that was a long time ago (too bad the docs
didn't say what version the default changed in, but we didn't used to be as
rigourous at listing versions for changes as we try to be now)

David Lang

On Fri, 1 Sep 2023, Kent Oyer wrote:

> Date: Fri, 01 Sep 2023 21:45:22 +0000
> From: Kent Oyer <kent@mxguardian.net>
> To: David Lang <david@lang.hm>
> Cc: Kent Oyer via rsyslog <rsyslog@lists.adiscon.com>
> Subject: Re[2]: [rsyslog] Rate limiting questions
>
> Hi David,
> Thanks for the quick response. I was able to download the documentation for my version and confirm that rate limiting is off by default. I'm still not sure what the difference is between "SysSock.RateLimit.Interval" and "RateLimit.Interval" but they both default to 0 so I'm good.
> The reason for my confusion was this paragraph in the docs: "The default of 0 has been chosen as people experienced problems with this feature activated by default. Now it needs an explicit opt-in by setting this parameter." The way I read that indicated to me that the default used to be non-zero at some point in the past.
> Thanks
> Kent
> On Fri, Sep 1, 2023 at 04:10 PM, David Lang <david@lang.hm> wrote:
> There should be documentation included with your distro, look for a -doc
> package.
>
> The documentation is maintained in git, so you can clone the repo and go back to
> whatever version you want.
>
> We do try to note what version a new feature is added in.
>
> We try REALLY hard to not break existing configs, and even changes to default
> values get a lot of debate to make sure they won't break things, and rarely
> happen
>
> The community only supports recent releases (although you can get a support
> contract with Adiscon for support of other versions)
>
> I don't think there is any throttling by default in rsyslog (although I think
> journald/imjournald may have some)
>
> Please post your full config (including included files, starting rsyslog with
> the -o /path/to/file option will create a combined file in /path/to/file showing
> how rsyslog sees all the configs together)
>
> If you are doing any rate limiting, you should be using the
> action()/module()/input() syntax rather than the prior syntax of setting
> multiple $foo values then invoking things. The new syntax is much clearer as it
> does not depend on side effects of prior statements.
>
> David Lang
>
> On Fri, 1 Sep 2023, Kent Oyer via rsyslog wrote:
>
> Hi there,
> 1. What is the difference between "SysSock.RateLimit.Interval" and "RateLimit.Interval" as mentioned on https://www.rsyslog.com/doc/v8-stable/configuration/modules/imuxsock.html (https://www.rsyslog.com/doc/v8-stable/configuration/modules/imuxsock.html)
> 2. I am running Debian 12 which comes with rsyslogd 8.2102.0. Where is the documentation for this version? I can only find documentation for the latest version (8.2308.0).
> 3. Specifically, I'm trying to find out what the default values are for the rate limiting parameters in version 8.2102.0. It seems that rate limiting used to be enabled by default but it was changed to disabled at some point.
>
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.