I don't think this is related to stunnel. I see that on my servers and I don't run stunnel on them On Jun 25, 2014 9:53 AM, "Paulraj Samikannu" [email protected] wrote:

I see the following messages on the production server, any special log setting requirement or is our stunnel generating too many messages too fast?

Jun 25 06:13:35 pprccmfaap001 rsyslogd-2177: imuxsock begins to drop messages from pid 171059 due to rate-limiting

Jun 25 06:15:34 pprccmfaap001 rsyslogd-2177: imuxsock lost 47 messages from pid 171059 due to rate-limiting

Jun 25 06:15:36 pprccmfaap001 rsyslogd-2177: imuxsock begins to drop messages from pid 171059 due to rate-limiting

---

stunnel-users mailing list [email protected] https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

Hum...you should try : ps -aef |grep 171059 or whatever pid you got, before suspecting stunnel or anything else...

Le 25/06/2014 15:52, Paulraj Samikannu a écrit :

I see the following messages on the production server, any special log setting requirement or is our stunnel generating too many messages too fast?

Jun 25 06:13:35 pprccmfaap001 rsyslogd-2177: imuxsock begins to drop messages from pid 171059 due to rate-limiting Jun 25 06:15:34 pprccmfaap001 rsyslogd-2177: imuxsock lost 47 messages from pid 171059 due to rate-limiting Jun 25 06:15:36 pprccmfaap001 rsyslogd-2177: imuxsock begins to drop messages from pid 171059 due to rate-limiting

---

stunnel-users mailing list [email protected] https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

Ok, Anyway it may be "normal" depending on your log level of stunnel and the limits you have set up for the logger.

If I were you, and wherever possible I would at least suppress any log from stunnel, and/or stop it temporarily, and then I would wait to see if any other log can lead to that kind of message :

I think that Jochen Bern gave the right direction : this msg is just a logger throughput warning.

It is too soon to say it reveals any pb in stunnel in itself.

Anyway, you should check also your firewall logs (iptables or anything else), to see if you have not some abnormal traffic rejected in high amount with a lot of alerts : in that case, it may reveal some spyware on one of your LAN machines.

Do that BEFORE imagining to increase your alert limits thresholds. If that situation is recent, it is worth trying to understand what kind of applications and/or traffic generated it (stunnel may be just being a little part of it).

Regards Pierre

Le 25/06/2014 16:24, Paulraj Samikannu a écrit :

Hi

That pid is pointing to the stunnel

-bash-4.1$ ps -aef |grep 171059 pa8l3h6 119597 20726 0 07:23 pts/1 00:00:00 grep 171059 root 171059 1 0 Jun14 ? 00:03:09 /usr/bin/stunnel /etc/stunnel/stunnel.conf

Thanks Paulraj

From: stunnel-users [mailto:[email protected]] On Behalf Of Pierre DELAAGE Sent: Wednesday, June 25, 2014 7:51 PM To: [email protected] Subject: Re: [stunnel-users] (no subject)

Hum...you should try : ps -aef |grep 171059 or whatever pid you got, before suspecting stunnel or anything else...

Le 25/06/2014 15:52, Paulraj Samikannu a écrit :

I see the following messages on the production server, any special log setting requirement or is our stunnel generating too many messages too fast?

Jun 25 06:13:35 pprccmfaap001 rsyslogd-2177: imuxsock begins to drop messages from pid 171059 due to rate-limiting

Jun 25 06:15:34 pprccmfaap001 rsyslogd-2177: imuxsock lost 47 messages from pid 171059 due to rate-limiting

Jun 25 06:15:36 pprccmfaap001 rsyslogd-2177: imuxsock begins to drop messages from pid 171059 due to rate-limiting

---

stunnel-users mailing list

[email protected]mailto:[email protected]

https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users