Bug 1022517

Summary: rate limiting does not work as expected
Product: Red Hat Enterprise Linux 7 Reporter: Dalibor Pospíšil <dapospis>
Component: rsyslogAssignee: Tomas Heinrich <theinric>
Status: CLOSED NOTABUG QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 7.0CC: dapospis, pvrabec
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-12-10 13:45:35 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Dalibor Pospíšil 2013-10-23 12:59:37 UTC 
Description of problem:
Rate limiting does not work. See /CoreOS/rsyslog/Sanity/bz672182-RFE-Provide-rate-limiting-support http://beaker-archive.app.eng.bos.redhat.com/beaker-logs/2013/10/5211/521186/1091577/16524460/TESTOUT.log

Version-Release number of selected component (if applicable):
rsyslog-7.4.2-3.el7

How reproducible:
100%

Steps to Reproduce:
1. # cat >>/etc/rsyslog.conf <<EOF
\$SystemLogRateLimitInterval 5
\$SystemLogRateLimitBurst 10
local2.*   /var/log/local2
EOF
2. # service rsyslog restart
3. # (for i in `seq 1 80`; do
            echo "testnumber$i"
            sleep 0.1s
          done) | logger -p local2.error

Actual results:
80 messages logged

Expected results:
20 messages logged
Comment 2 Tomas Heinrich 2013-12-05 14:39:29 UTC 
Just a note:

In rsyslog 7.4.2, the messages aren't read from the system log socket. They are read directly from journal and therefore instead of

$SystemLogRateLimit*

you'll have to use

$ImjournalRateLimit*

Please, give this a try and perhaps close this as not-a-bug.
Comment 3 Dalibor Pospíšil 2013-12-10 13:45:35 UTC 
I have fixed the test so for RHEL-7 it uses ImjournalRateLimit and ti work correctly.