我正在使用 rsyslog 服务器来保存各种服务器的日志。最近我在 rsyslog 中添加了 20 个服务器，此后 rsyslog 经常挂起服务（直到服务重新启动才收到日志）。我观察了内存使用情况，当内存达到 456MB 时它就会挂起。
我该如何摆脱这个问题。Rsyslog 服务器有 16 GB RAM，它使用的内存不超过 2 GB。
你好，蒂亚戈，
感谢您的快速回复，请找到您所需的日志。
sudo cat /var/log/messages | grep rsyslog
[root@rsyslog ~]# cat /var/log/messages | grep rsyslog
Sep 4 23:38:54 rsyslog rsyslogd: -- MARK --
Sep 5 11:25:08 rsyslog rsyslogd: -- MARK --
Sep 5 15:50:12 rsyslog kernel: imklog 5.8.10, log source = /proc/kmsg started.
Sep 5 15:50:12 rsyslog rsyslogd: [origin software="rsyslogd" swVersion="5.8.10" x-pid="10706" x-info="http://www.rsyslog.com"] start
Sep 5 15:50:12 rsyslog rsyslogd-3000: unknown priority name "" [try http://www.rsyslog.com/e/3000 ]
Sep 5 15:50:12 rsyslog rsyslogd: the last error occured in /etc/rsyslog.conf, line 3:"RSYSLOG_DEBUG="Debug NoStdOut""
Sep 5 15:50:12 rsyslog rsyslogd: warning: selector line without actions will be discarded
Sep 5 15:50:12 rsyslog rsyslogd-3000: unknown priority name "" [try http://www.rsyslog.com/e/3000 ]
Sep 5 15:50:12 rsyslog rsyslogd: the last error occured in /etc/rsyslog.conf, line 4:"RSYSLOG_DEBUGLOG="/var/log/syslog-debug""
Sep 5 15:50:12 rsyslog rsyslogd: warning: selector line without actions will be discarded
Sep 5 15:50:12 rsyslog rsyslogd-2124: CONFIG ERROR: could not interpret master config file '/etc/rsyslog.conf'. [try http://www.rsyslog.com/e/2124 ]
Sep 5 16:11:24 rsyslog kernel: imklog 5.8.10, log source = /proc/kmsg started.
Sep 5 16:11:24 rsyslog rsyslogd: [origin software="rsyslogd" swVersion="5.8.10" x-pid="10919" x-info="http://www.rsyslog.com"] start
Sep 5 16:11:24 rsyslog rsyslogd-3000: unknown priority name "" [try http://www.rsyslog.com/e/3000 ]
Sep 5 16:11:24 rsyslog rsyslogd: the last error occured in /etc/rsyslog.conf, line 3:"RSYSLOG_DEBUG="Debug NoStdOut""
Sep 5 16:11:24 rsyslog rsyslogd: warning: selector line without actions will be discarded
Sep 5 16:11:24 rsyslog rsyslogd-3000: unknown priority name "" [try http://www.rsyslog.com/e/3000 ]
Sep 5 16:11:24 rsyslog rsyslogd: the last error occured in /etc/rsyslog.conf, line 4:"RSYSLOG_DEBUGLOG="/var/log/syslog-debug""
Sep 5 16:11:24 rsyslog rsyslogd: warning: selector line without actions will be discarded
Sep 5 16:11:24 rsyslog rsyslogd-2124: CONFIG ERROR: could not interpret master config file '/etc/rsyslog.conf'. [try http://www.rsyslog.com/e/2124 ]
Sep 5 16:54:59 rsyslog kernel: imklog 5.8.10, log source = /proc/kmsg started.
Sep 5 16:54:59 rsyslog rsyslogd: [origin software="rsyslogd" swVersion="5.8.10" x-pid="11231" x-info="http://www.rsyslog.com"] start
Sep 5 16:54:59 rsyslog rsyslogd-3000: unknown priority name "" [try http://www.rsyslog.com/e/3000 ]
Sep 5 16:54:59 rsyslog rsyslogd: the last error occured in /etc/rsyslog.conf, line 3:"RSYSLOG_DEBUG="Debug NoStdOut""
Sep 5 16:54:59 rsyslog rsyslogd: warning: selector line without actions will be discarded
Sep 5 16:54:59 rsyslog rsyslogd-3000: unknown priority name "" [try http://www.rsyslog.com/e/3000 ]
Sep 5 16:54:59 rsyslog rsyslogd: the last error occured in /etc/rsyslog.conf, line 4:"RSYSLOG_DEBUGLOG="/var/log/syslog-debug""
Sep 5 16:54:59 rsyslog rsyslogd: warning: selector line without actions will be discarded
Sep 5 16:54:59 rsyslog rsyslogd-2124: CONFIG ERROR: could not interpret master config file '/etc/rsyslog.conf'. [try http://www.rsyslog.com/e/2124 ]
Sep 5 17:42:53 rsyslog kernel: imklog 5.8.10, log source = /proc/kmsg started.
Sep 5 17:42:53 rsyslog rsyslogd: [origin software="rsyslogd" swVersion="5.8.10" x-pid="11562" x-info="http://www.rsyslog.com"] start
Sep 5 17:42:53 rsyslog rsyslogd-3000: unknown priority name "" [try http://www.rsyslog.com/e/3000 ]
Sep 5 17:42:53 rsyslog rsyslogd: the last error occured in /etc/rsyslog.conf, line 3:"RSYSLOG_DEBUG="Debug NoStdOut""
Sep 5 17:42:53 rsyslog rsyslogd: warning: selector line without actions will be discarded
Sep 5 17:42:53 rsyslog rsyslogd-3000: unknown priority name "" [try http://www.rsyslog.com/e/3000 ]
Sep 5 17:42:53 rsyslog rsyslogd: the last error occured in /etc/rsyslog.conf, line 4:"RSYSLOG_DEBUGLOG="/var/log/syslog-debug""
Sep 5 17:42:53 rsyslog rsyslogd: warning: selector line without actions will be discarded
Sep 5 17:42:53 rsyslog rsyslogd-2124: CONFIG ERROR: could not interpret master config file '/etc/rsyslog.conf'. [try http://www.rsyslog.com/e/2124 ]
Sep 5 17:59:16 rsyslog kernel: fuse init (API version 7.14)
Sep 5 17:59:16 rsyslog seahorse-daemon[11835]: DNS-SD initialization failed: Daemon not running
Sep 5 17:59:16 rsyslog seahorse-daemon[11835]: init gpgme version 1.1.8
Sep 5 17:59:18 rsyslog polkitd[12048]: started daemon version 0.96 using authority implementation `local' version `0.96'
Sep 5 17:59:19 rsyslog vmusr[11909]: [ warning] [Gtk] Unable to locate theme engine in module_path: "clearlooks",
Sep 5 17:59:19 rsyslog vmusr[11909]: [ warning] [Gtk] Unable to locate theme engine in module_path: "clearlooks",
Sep 5 17:59:19 rsyslog vmusr[11909]: [ warning] [Gtk] Unable to locate theme engine in module_path: "clearlooks",
Sep 5 17:59:19 rsyslog vmusr[11909]: [ warning] [Gtk] Unable to locate theme engine in module_path: "clearlooks",
Sep 5 17:59:19 rsyslog vmusr[11909]: [ warning] [Gtk] Unable to locate theme engine in module_path: "clearlooks",
Sep 5 17:59:19 rsyslog vmusr[11909]: [ warning] [Gtk] Unable to locate theme engine in module_path: "clearlooks",
Sep 5 17:59:19 rsyslog vmusr[11909]: [ warning] [Gtk] Unable to locate theme engine in module_path: "clearlooks",
Sep 5 17:59:19 rsyslog vmusr[11909]: [ warning] [Gtk] Unable to locate theme engine in module_path: "clearlooks",
Sep 5 17:59:19 rsyslog vmusr[11909]: [ warning] [Gtk] Unable to locate theme engine in module_path: "clearlooks",
Sep 5 17:59:19 rsyslog vmusr[11909]: [ warning] [Gtk] Unable to locate theme engine in module_path: "clearlooks",
Sep 5 17:59:19 rsyslog vmusr[11909]: [ warning] [Gtk] Unable to locate theme engine in module_path: "clearlooks",
Sep 5 17:59:19 rsyslog vmusr[11909]: [ warning] [Gtk] Unable to locate theme engine in module_path: "clearlooks",
Sep 5 17:59:19 rsyslog vmusr[11909]: [ warning] [Gtk] Unable to locate theme engine in module_path: "clearlooks",
Sep 5 17:59:19 rsyslog vmusr[11909]: [ warning] [Gtk] Unable to locate theme engine in module_path: "clearlooks",
Sep 5 17:59:19 rsyslog vmusr[11909]: [ warning] [Gtk] Unable to locate theme engine in module_path: "clearlooks",
Sep 5 17:59:19 rsyslog vmusr[11909]: [ warning] [Gtk] Unable to locate theme engine in module_path: "clearlooks",
Sep 5 17:59:19 rsyslog vmusr[11909]: [ warning] [Gtk] Unable to locate theme engine in module_path: "clearlooks",
Sep 5 17:59:19 rsyslog vmusr[11909]: [ warning] [Gtk] gtk_disable_setlocale() must be called before gtk_init()
Sep 5 18:00:28 rsyslog ntpd[6805]: ntpd exiting on signal 15
Sep 5 18:00:28 rsyslog ntpd[12245]: ntpd [email protected] Sat Nov 23 18:21:48 UTC 2013 (1)
Sep 5 18:00:28 rsyslog ntpd[12246]: proto: precision = 0.061 usec
Sep 5 18:00:28 rsyslog ntpd[12246]: 0.0.0.0 c01d 0d kern kernel time sync enabled
Sep 5 18:00:28 rsyslog ntpd[12246]: Listen and drop on 0 v4wildcard 0.0.0.0 UDP 123
Sep 5 18:00:28 rsyslog ntpd[12246]: Listen and drop on 1 v6wildcard :: UDP 123
Sep 5 18:00:28 rsyslog ntpd[12246]: Listen normally on 2 lo 127.0.0.1 UDP 123
Sep 5 18:00:28 rsyslog ntpd[12246]: Listen normally on 4 eth0 fe80::250:56ff:feba:de61 UDP 123
Sep 5 18:00:28 rsyslog ntpd[12246]: Listen normally on 5 lo ::1 UDP 123
Sep 5 18:00:28 rsyslog ntpd[12246]: peers refreshed
Sep 5 18:00:28 rsyslog ntpd[12246]: Listening on routing socket on fd #22 for interface updates
Sep 5 18:00:28 rsyslog ntpd[12246]: 0.0.0.0 c016 06 restart
Sep 5 18:00:28 rsyslog ntpd[12246]: 0.0.0.0 c012 02 freq_set kernel -39.564 PPM
Sep 5 18:02:44 rsyslog init: tty (/dev/tty1) main process ended, respawning
Sep 5 18:02:53 rsyslog rsyslogd: -- MARK --
Sep 5 18:03:42 rsyslog ntpd[12246]: 0.0.0.0 c615 05 clock_sync
Sep 5 18:22:53 rsyslog rsyslogd: -- MARK --
Sep 5 18:42:53 rsyslog rsyslogd: -- MARK --
Sep 5 19:02:53 rsyslog rsyslogd: -- MARK --
Sep 5 19:22:53 rsyslog rsyslogd: -- MARK --
Sep 6 12:30:35 rsyslog kernel: imklog 5.8.10, log source = /proc/kmsg started.
Sep 6 12:30:35 rsyslog rsyslogd: [origin software="rsyslogd" swVersion="5.8.10" x-pid="18673" x-info="http://www.rsyslog.com"] start
Sep 6 12:50:35 rsyslog rsyslogd: -- MARK --
===================================================
rsyslog.conf 文件
rsyslog v5 配置文件
RSYSLOG_DEBUG="调试NoStdOut"
RSYSLOG_DEBUGLOG="/var/log/syslog-debug"
有关更多信息，请参阅 /usr/share/doc/rsyslog-*/rsyslog_conf.html
如果遇到问题，请参阅http://www.rsyslog.com/doc/troubleshoot.html
模块$ModLoad imuxsock # 提供对本地系统日志记录的支持（例如通过 logger 命令） $ModLoad imklog # 提供内核日志记录支持（之前由 rklogd 完成） $ModLoad immark # 提供 --MARK-- 消息功能 $ModLoad ommysql
提供 UDP 系统日志接收
$ModLoad imudp $UDPServerRun 514
提供 TCP 系统日志接收
$ModLoad imtcp $InputTCPServerRun 514
全球指令使用默认时间戳格式
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
默认情况下，文件同步功能处于禁用状态。此功能通常不需要，
毫无用处，且性能受到极大影响
$ActionFileEnableSync 开启
将所有配置文件包含在 /etc/rsyslog.d/ 中
$IncludeConfig /etc/rsyslog.d/*.conf
规则将所有内核消息记录到控制台。
记录太多其他内容会使屏幕变得混乱。
内核。* /dev/console
kern.* /var/log/console
记录信息级别或更高级别的任何内容（邮件除外）。
不要记录私人身份验证信息！
*.信息；mail.none；authpriv.none；cron.none /var/log/messages
authpriv 文件的访问权限受到限制。
authpriv。* /var/log/secure
将所有邮件信息记录在一个地方。
邮件。*-/var/log/maillog
记录 cron 内容
cron。* /var/log/cron
每个人都会收到紧急消息
*.紧急*
将 crit 级别及更高级别的新闻错误保存在一个特殊文件中。
uucp,news.crit /var/log/spooler
还将启动消息保存到 boot.log
本地7.* /var/log/boot.log
$AllowedSender TCP，127.0.0.1，192.**** $AllowedSender UDP，127.0.0.1，192.****
$AllowedSender TCP，127.0.0.1，192.**** $AllowedSender UDP，127.0.0.1，192.****
。:ommysql:127.0.0.1,rsyslogdb,rsyslog,我的密码
### 开始转发规则
begin ... end 之间的语句定义了一个单一的转发
规则。它们属于同一组，请勿拆分。如果您创建多个
转发规则，复制整个区块！
远程日志记录（我们使用 TCP 进行可靠传输）
#
将为此操作创建一个磁盘队列。如果远程主机
当服务器宕机时，消息会被缓存到磁盘并在服务器恢复运行后发送。
$WorkDirectory /var/lib/rsyslog # 放置假脱机文件的位置
$ActionQueueFileName fwdRule1 # 假脱机文件的唯一名称前缀
$ActionQueueMaxDiskSpace 1g # 1gb 空间限制（尽可能使用）
$ActionQueueSaveOnShutdown on # 关机时将消息保存到磁盘
$ActionQueueType LinkedList # 异步运行
$ActionResumeRetryCount -1 # 如果主机宕机则无限次重试
远程主机为：名称/ip:端口，例如 192.168.0.1:514，端口可选
。@@远程主机:514
### 转发规则结束
用于更高精度时间戳和严重性日志记录的模板
$模板 SpiceTmpl，“%TIMESTAMP%.%TIMESTAMP:::date-subseconds% %syslogtag% %syslogseverity-text%:%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n”
:programname, startswith, "spice-vdagent" /var/log/spice-vdagent.log;SpiceTmpl