On 25.06.2014 15:53, Paulraj Samikannu wrote:

I see the following messages on the production server, any special log setting requirement or is our stunnel generating too many messages too fast?

Jun 25 06:13:35 pprccmfaap001 rsyslogd-2177: imuxsock begins to drop messages from pid 171059 due to rate-limiting Jun 25 06:15:34 pprccmfaap001 rsyslogd-2177: imuxsock lost 47 messages from pid 171059 due to rate-limiting

Can't comment on the specifics of stunnel, but rsyslogd brought rate limiting on the UNIX socket by default into a world where maintainers of daemons have never thought much about what *PID* may be attached to the messages they send to the syslog.

dovecot (logging per-connection messages through the master process all the time) and OpenVPN (dumping config, including the persisted assignment of pool IPs to clients, into syslog at startup) are the most affected software on my end, and yes, I happily raise the rate limit to whatever the former needs.

# grep -A 2 imuxsock /etc/rsyslog.conf $ModLoad imuxsock # provides support for local system logging (e.g. via logger command) $SystemLogRateLimitInterval 5 # Default: 5 (seconds) $SystemLogRateLimitBurst 1500 # Default: 200 (messages)

Regards, J. Bern

Ok, Anyway it may be "normal" depending on your log level of stunnel and the limits you have set up for the logger.

If I were you, and wherever possible I would at least suppress any log from stunnel, and/or stop it temporarily, and then I would wait to see if any other log can lead to that kind of message :

I think that Jochen Bern gave the right direction : this msg is just a logger throughput warning.

It is too soon to say it reveals any pb in stunnel in itself.

Anyway, you should check also your firewall logs (iptables or anything else), to see if you have not some abnormal traffic rejected in high amount with a lot of alerts : in that case, it may reveal some spyware on one of your LAN machines.

Do that BEFORE imagining to increase your alert limits thresholds. If that situation is recent, it is worth trying to understand what kind of applications and/or traffic generated it (stunnel may be just being a little part of it).

Regards Pierre

Le 25/06/2014 16:24, Paulraj Samikannu a écrit :

Hi

That pid is pointing to the stunnel

-bash-4.1$ ps -aef |grep 171059 pa8l3h6 119597 20726 0 07:23 pts/1 00:00:00 grep 171059 root 171059 1 0 Jun14 ? 00:03:09 /usr/bin/stunnel /etc/stunnel/stunnel.conf

Thanks Paulraj

From: stunnel-users [mailto:[email protected]] On Behalf Of Pierre DELAAGE Sent: Wednesday, June 25, 2014 7:51 PM To: [email protected] Subject: Re: [stunnel-users] (no subject)

Hum...you should try : ps -aef |grep 171059 or whatever pid you got, before suspecting stunnel or anything else...

Le 25/06/2014 15:52, Paulraj Samikannu a écrit :

I see the following messages on the production server, any special log setting requirement or is our stunnel generating too many messages too fast?

Jun 25 06:13:35 pprccmfaap001 rsyslogd-2177: imuxsock begins to drop messages from pid 171059 due to rate-limiting

Jun 25 06:15:34 pprccmfaap001 rsyslogd-2177: imuxsock lost 47 messages from pid 171059 due to rate-limiting

Jun 25 06:15:36 pprccmfaap001 rsyslogd-2177: imuxsock begins to drop messages from pid 171059 due to rate-limiting

---

stunnel-users mailing list

[email protected]mailto:[email protected]

https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users