CentOS/RHEL usually uses rsyslogd rate-limit mechanism. However, CentOS/RHEL 7.x comes with systemd journal integrated to provide the ability to import structured log messages from systemd journal to syslog.
The journal messages on the system’s /var/log/messages file looks like in the following example:
Jul 30 03:29:45 hostname rsyslogd: imjournal: 102776 messages lost due to rate-limiting
How can we disable or extend this logging rate limitation feature on CentOS/RHEL 7.x?
Disable or Extend System Logging Rate-limit
To disable the rsyslogd logging rate-limit on CentOS/RHEL 7 perform the following steps:
1. Edit the file “/etc/rsyslog.conf” and modify the following parameters.
$SystemLogRateLimitInterval 5 $SystemLogRateLimitBurst 30000
Change these to:
$SystemLogRateLimitInterval 0 $SystemLogRateLimitBurst 0
2. Add the following parameter after “$ModLoad imjournal” under section “#### MODULES ####”
$ImjournalRateLimitInterval 0
or
module(load="imjournal" ratelimit.interval="0")
Either parameter works the same, the difference is that the first line is an old syntax and the second is the new syntax, which is preferred.
3. Edit the file “/etc/systemd/journald.conf” and comment the following parameters:
RateLimitInterval=5s RateLimitBurst=30000
Change these to (add symbol # in the beginning):
#RateLimitInterval=5s #RateLimitBurst=30000
4. Restart rsyslog and journal service:
# systemctl restart systemd-journald # systemctl restart rsyslog
Conclusion
The rate limitation prevents logging from using excessive levels of system resources and to flood the /var/log/message with unnecessary messages. To log an event, it needs to be written to disk which uses system resources. If there are too many repetitive events coming in recorded to disk in a specific period of time, they can overwhelm a system and cause more important services to respond slowly or even an unexpected failure. Therefore, disabling rate-limiting it is generally not recommended, but some times it would be required for diagnostic purposes.