CentOS/RHEL usually uses rsyslogd rate-limit mechanism. Below is an example of message logged in /var/log/messages due to rsyslog rate-limiting.
Feb 9 10:22:32 localhost rsyslogd: imuxsock lost 432 messages from pid 9832 due to rate-limiting Feb 9 10:22:45 localhost rsyslogd: imuxsock begins to drop messages from pid 9832 due to rate-limiting
The rate limitation prevents logging from using excessive levels of system resources and to flood the /var/log/message with unnecessary messages. To log an event, it needs to be written to disk which uses system resources. If there are too many repetitive events coming in recorded to disk in a specific period of time, they can overwhelm a system and cause more important services to respond slowly or even an unexpected failure. Therefore, disabling rate-limiting it is generally not recommended, but some times it would be required for diagnostic purposes.
Follow the steps given below to disable or extend the rsyslogd rate-limiting in CentOS/RHEL 6.
1. Edit the rsyslogd configuration file /etc/rsyslog.conf:
# vi /etc/rsyslog.conf
2. Add the following parameters under “$ModLoad imuxsock” section.
$SystemLogRateLimitInterval 0 $SystemLogRateLimitBurst 0 $IMUxSockRateLimitBurst 0 $IMUXSockRateLimitInterval 0 $IMUxSockRateLimitSeverity 7
3. Restart rsyslog for the changes to take effect:
# service rsyslog restart
imuxsock is the name of the module that handles Unix Socket. This module manages the delivery of syslog calls from a logging process to rsyslog. The module listens to the log sockets of a Unix system and gives rsyslog the log messages when they occur.
SystemLogRateLimitInterval is the amount of time that is being measured for rate limiting. The default value of this parameter is set to 5 seconds.
The SystemLogRateLimitBurst defines the amount of messages, that have to occur in the time limit of SystemLogRateLimitInterval, to trigger rate limiting. The default parameter value is 200 messages.
$IMUXSockRateLimitBurst [number] – equivalent to: RateLimit.Burst, specifies the rate-limiting burst in number of messages.
$IMUXSockRateLimitSeverity [numerical severity] – equivalent to: RateLimit.Severity, specifies the severity of messages.
“IMUxSockRate*“is necessary when imuxsock is independent from syssock, like with SysSock.Use = “off”.
“$IMUxSockRateLimitSeverity” is not necessary for disabling ratelimitting, but better only if ratelimit messages are accidentally logged.