Bug 1022517 - rate limiting does not work as expected
Summary: rate limiting does not work as expected
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: rsyslog
Version: 7.0
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Tomas Heinrich
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-10-23 12:59 UTC by Dalibor Pospíšil
Modified: 2016-09-20 04:51 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-12-10 13:45:35 UTC
Target Upstream Version:

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Description Dalibor Pospíšil 2013-10-23 12:59:37 UTC 
Description of problem:
Rate limiting does not work. See /CoreOS/rsyslog/Sanity/bz672182-RFE-Provide-rate-limiting-support http://beaker-archive.app.eng.bos.redhat.com/beaker-logs/2013/10/5211/521186/1091577/16524460/TESTOUT.log

Version-Release number of selected component (if applicable):
rsyslog-7.4.2-3.el7

How reproducible:
100%

Steps to Reproduce:
1. # cat >>/etc/rsyslog.conf <<EOF
\$SystemLogRateLimitInterval 5
\$SystemLogRateLimitBurst 10
local2.*   /var/log/local2
EOF
2. # service rsyslog restart
3. # (for i in `seq 1 80`; do
            echo "testnumber$i"
            sleep 0.1s
          done) | logger -p local2.error

Actual results:
80 messages logged

Expected results:
20 messages logged
Comment 2 Tomas Heinrich 2013-12-05 14:39:29 UTC 
Just a note:

In rsyslog 7.4.2, the messages aren't read from the system log socket. They are read directly from journal and therefore instead of

$SystemLogRateLimit*

you'll have to use

$ImjournalRateLimit*

Please, give this a try and perhaps close this as not-a-bug.
Comment 3 Dalibor Pospíšil 2013-12-10 13:45:35 UTC 
I have fixed the test so for RHEL-7 it uses ImjournalRateLimit and ti work correctly.
Note You need to log in before you can comment on or make changes to this bug.