rsyslogd-2079: too many tcp sessions

hilou · 08-08-2016, 10:21 AM

Hi All,

I met a rsyslog issue today. I have a rsyslog server to collect about 700 servers's log. But I got lots of error log like below:

Code:

2016-08-08T23:06:13.116992+08:00	hostname ip	5	3	rsyslogd-2079:	 too many tcp sessions - dropping incoming request [try http://www.rsyslog.com/e/2079 ]

And I got a 403 when try to access the page: http://www.rsyslog.com/e/2079

I have increated the InputTCPMaxSessions config to 3000. Check my config below:

Code:

# Use traditional timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# config maxmize TCP connections
$InputTCPMaxSessions 3000
# Provides kernel logging support (previously done by rklogd)
$ModLoad imklog

# Provides support for local system logging (e.g. via logger command)
$ModLoad imuxsock

$ModLoad imfile
# auditd audit.log

I got about 200 established connections with netstat -an | grep -i estab

Please help. I don't know what else I can do to fix this.

Code:

rsyslogd -v
rsyslogd 3.22.1

Emerson · 08-09-2016, 04:49 AM

Where you load imtcp module? $InputTCPMaxSessions cannot be set before the module is loaded.

Habitual · 08-09-2016, 07:28 AM

rsyslogd 3 ?
Eek. Appliance?

jpollard · 08-09-2016, 08:08 AM

The usual upper limit is 1024 due to the limit on the select system call (and remember to subtract stderr/stdout and maybe stdin as well).

There appear to be some workarounds to this limit - but it looks to require compile time options to enable it (and there may be some kernel configurations to allow it - I can't tell from the source).

reference: http://git.adiscon.com/?p=rsyslog.gi...27ceb4443cbffe

hilou · 08-09-2016, 09:19 AM

Thank you all for your help. I fixed this by updating rsyslog to version 5.

But still don't know why version 3 doesn't work.

@ Emerson
$ModLoad imtcp is configured at the first line, and it's not in my config snippet.

@ Habitual
rsyslog3 doesn't support InputTCPMaxSessions config ?

@ jpollard
It should be working if the limit is 1024 since I have only about 700 servers.

jpollard · 08-09-2016, 09:36 AM

Quote:

Originally Posted by hilou

Thank you all for your help. I fixed this by updating rsyslog to version 5.

But still don't know why version 3 doesn't work.
,,,
@ jpollard
It should be working if the limit is 1024 since I have only about 700 servers.

Assuming each server only makes ONE connection. Granted I would think that would be the usual case, but sometimes two different message levels are wanted with two different entries - and that might make two connections.