rsyslog

The rocket-fast system for log processing

First try to test rate limiting

By Adiscon SupportPosted on Posted in sub-faqTagged , , , , , ,

Go back to Changing the settings

For a first test of the rate limiting feature we made up our mind on how to test it. We soon came up with the idea of a small shell script that will run logger with a test message. The script looks as follows

n=1000
i=0

while [ $i -lt $n ]
do
logger "This is Testmessage #$i"
echo "Messages: $i"
i=`expr $i + 1`
done

In this example, we have a pretty simple while loop. The loop will terminate, once the variable i has the size of n. In every run, i will be incremented by 1. After that a message is logged via logger and the message will be written to the terminal. You can download the script file here. Please note, that after downloading, you need to set chmod to 755 for this file.

Now run the file.

/foldername/ratelimittest

You will see a lot of lines being written to the terminal. In the current configuration, the while loop has 1000 iterations. When finished, the terminal will show the input prompt again. We can now review the log file to see if rate limiting worked.

vi /var/log/everything.log
Oct  5 17:01:57 client test: This is Testmessage #43
Oct  5 17:01:57 client test: This is Testmessage #44
Oct  5 17:01:57 client test: This is Testmessage #45
Oct  5 17:01:57 client test: This is Testmessage #46
Oct  5 17:01:57 client test: This is Testmessage #47
Oct  5 17:01:57 client test: This is Testmessage #48
Oct  5 17:01:57 client test: This is Testmessage #49
Oct  5 17:01:57 client test: This is Testmessage #50
Oct  5 17:01:57 client test: This is Testmessage #51
Oct  5 17:01:57 client test: This is Testmessage #52
Oct  5 17:01:57 client test: This is Testmessage #53
Oct  5 17:01:57 client test: This is Testmessage #54
Oct  5 17:01:57 client test: This is Testmessage #55
Oct  5 17:01:57 client test: This is Testmessage #56
Oct  5 17:01:57 client test: This is Testmessage #57
Oct  5 17:01:57 client test: This is Testmessage #58
Oct  5 17:01:57 client test: This is Testmessage #59
Oct  5 17:01:57 client test: This is Testmessage #60
Oct  5 17:01:57 client test: This is Testmessage #61

Let’s take a look at the messages around message 50. Usually, there should be a message after message 50, that some messages are not logged due to rate limiting. So either our test is not suitable because of the runtime or it isn’t  recognized correctly. To check on this, we make another change to the rsyslog configuration file as we did before. Again, go to the section for imuxsock at the beginning. Now we add a third option for imuxsock.

$SystemLogUsePIDFromSystem on

With this option, the PID of the process that is sending a message to imuxsock will be added to the log. Therefore we can check if the process has run correctly. Save the config and restart rsyslog again. Now once more, let the script run and take a look at the log afterwards.

Oct  5 17:27:01 client test[6941]: This is Testmessage #41
Oct  5 17:27:01 client test[6943]: This is Testmessage #42
Oct  5 17:27:02 client test[6945]: This is Testmessage #43
Oct  5 17:27:02 client test[6947]: This is Testmessage #44
Oct  5 17:27:02 client test[6949]: This is Testmessage #45
Oct  5 17:27:02 client test[6951]: This is Testmessage #46
Oct  5 17:27:02 client test[6953]: This is Testmessage #47
Oct  5 17:27:02 client test[6955]: This is Testmessage #48
Oct  5 17:27:02 client test[6957]: This is Testmessage #49
Oct  5 17:27:02 client test[6959]: This is Testmessage #50
Oct  5 17:27:02 client test[6961]: This is Testmessage #51
Oct  5 17:27:02 client test[6963]: This is Testmessage #52
Oct  5 17:27:02 client test[6965]: This is Testmessage #53
Oct  5 17:27:02 client test[6967]: This is Testmessage #54
Oct  5 17:27:02 client test[6969]: This is Testmessage #55
Oct  5 17:27:02 client test[6971]: This is Testmessage #56
Oct  5 17:27:02 client test[6973]: This is Testmessage #57
Oct  5 17:27:02 client test[6975]: This is Testmessage #58
Oct  5 17:27:02 client test[6977]: This is Testmessage #59
Oct  5 17:27:02 client test[6979]: This is Testmessage #60

What we see now behind the username is the PID (Process ID). As we can see now, the PID is different for every log entry. That means, that a new process has been started for every message, thus rendering our test useless, because rate limiting only works if the same PID is given.

Therefore we need a specialized test tool. How to build the appropriate tool is shown on the next page.

Go on to How to build test-tools?

Scroll to top