imuxsock begins to drop messages from pid due to rate-limiting

Products

• CA API Gateway

Issue/Introduction

Seeing the below message in the gateway main logs:

<hostname> rsyslogd-2177: imuxsock begins to drop messages from pid 22992 due to rate-limiting
<hostname> rsyslogd-2177: imuxsock lost 115 messages from pid 22992 due to rate-limiting

What is this message about?
Will it impact the gateway?
What does it mean?

Environment

All supported versions of the API Gateway

Cause

Those messages mean that in 5 seconds, a process sends more than 200 messages to rsyslog. At this point, rsyslog will drop messages if rate limiting is enabled. 

NOTICE: This is a safeguard measure to prevent logs from filling the /var partition. Exercise care if you disable rate limiting, as it might fill your log partition. It is often better to investigate which process is flooding the logs with messages and resolve this issue. Often, an application will be set at a ""debug"" log level, which will cause very verbose logging. If the logging is not needed, please lower the logging level. 

Resolution

You are getting Rate limit messages at syslog. 
This is simply the o/s saying you are writing to many messages at the same time we are not going to take all of them (we will drop some). To prevent this imuxsock rate limit: 

1.Edit /etc/rsyslog.conf 

2.Add the following parameters under ""$ModLoad imuxsock # needs to be done just once"" section. 

$SystemLogRateLimitInterval 0 
$SystemLogRateLimitBurst 0 
$IMUxSockRateLimitBurst 0 
$IMUXSockRateLimitInterval 0 
$IMUxSockRateLimitSeverity 7 

3.Restart rsyslog: 

# service rsyslog restart 

More details about the parameters mentioned above: 

$SystemLogRateLimitInterval [number] 
$SystemLogRateLimitBurst [number] 

The SystemLogRateLimitInterval determines the amount of time that is being measured for rate limiting. By default this is set to 5 seconds. The SystemLogRateLimitBurst defines the amount of messages, that have to occur in the time limit of SystemLogRateLimitInterval, to trigger rate limiting. Here, the default is 200 messages. For creating a more effective test, we will alter the default values. 

$IMUXSockRateLimitBurst [number] - equivalent to: RateLimit.Burst, specifies the rate-limiting burst in number of messages. Default is 200. 

$IMUXSockRateLimitSeverity [numerical severity] - equivalent to: RateLimit.Severity, which specifies the severity of messages that shall be rate-limited.