On 2018-03-04 10:13, Michael Hirmke wrote:
Hi,
[...]
Syslog-ng is killed by a single rule? wow ...
no, not by the rule as single cause, but: Since Leap 42.3 syslog-ng already uses up 100% cpu time and doesn't keep up with lots of messages. Sometimes it lags back for over an hour. I opened a bug report last August, but didn't get any answer yet:
The report doesn't mention what kind of load this syslog-ng has. Is it local or remote? Many messages or few? If it is local, ie, messages from only self, from the same machine, I found out that only rsyslog does adequate taking of messages from the systemd journal. If the journal is configured to produce no files, the syslog daemons get no data at all because they are reading from the files. Except rsyslog, which continue working. I did the experiment many months ago. -- Cheers / Saludos, Carlos E. R. (from 42.2 x86_64 "Malachite" at Telcontar)