imuxsock begins to drop messages from pid due to rate-limiting

Document ID : KB000124815
Last Modified Date : 22/01/2019
Show Technical Document Details
Question:
Seeing below message in gateway main logs:
What is this message about?
Will it impact gateway?
What does it mean?
Jan 14 03:21:26 <hostname> rsyslogd-2177: imuxsock begins to drop messages from pid 22992 due to rate-limiting
Jan 14 03:21:28 <hostname> rsyslogd-2177: imuxsock lost 115 messages from pid 22992 due to rate-limiting
Answer:
You are getting Rate limit messages at syslog. 
This is simply the o/s saying you are writing to many messages at the same time we are not going to take all of them (we will drop some). 
TO prevent this imuxsock rate limit you 

1.Edit /etc/rsyslog.conf 

2.Add the following parameters under ""$ModLoad imuxsock # needs to be done just once"" section. 

$SystemLogRateLimitInterval 0 
$SystemLogRateLimitBurst 0 
$IMUxSockRateLimitBurst 0 
$IMUXSockRateLimitInterval 0 
$IMUxSockRateLimitSeverity 7 

3.Restart rsyslog: 

# service rsyslog restart 

More details about the parameters mentioned above: 

$SystemLogRateLimitInterval [number] 
$SystemLogRateLimitBurst [number] 

The SystemLogRateLimitInterval determines the amount of time that is being measured for rate limiting. By default this is set to 5 seconds. The SystemLogRateLimitBurst defines the amount of messages, that have to occur in the time limit of SystemLogRateLimitInterval, to trigger rate limiting. Here, the default is 200 messages. For creating a more effective test, we will alter the default values. 

$IMUXSockRateLimitBurst [number] - equivalent to: RateLimit.Burst, specifies the rate-limiting burst in number of messages. Default is 200. 

$IMUXSockRateLimitSeverity [numerical severity] - equivalent to: RateLimit.Severity, which specifies the severity of messages that shall be rate-limited. 

Root Cause: Those messages means that in 5 seconds, a process sends more than 200 messages to rsyslog. At this point, rsyslog will drop messages if rate limiting is enabled. 

NOTICE: This is a safeguard measure to prevent logs from filling the /var partition. Exercise care if you disable rate limiting, as it might fill your log partition. It is often better to investigate which process is flooding the logs with messages and resolve this issue. Often, an application will be set at a ""debug"" log level, which will cause very verbose logging. If the logging is not needed, please lower the logging level.