RHEL 7 and CentOS 7 syslog Rate Limit

In RHEL 7 there is rate-limiting both in systemd-journald and in rsyslog's imjournal module

Lower Ratelimit Interval

Lower the interval for rate-limiting and increase the burst level in order to minimize the possibility of losing log messages when the threshold is reached for the specified number of messages logged within the specified interval. Rate-limiting is specific to each process, so there's usually no reason to change this. It is also inadvisable to disable this feature entirely!
grep -i rate /etc/systemd/journald.conf

grep -i rate /etc/rsyslog.conf

#$imjournalRatelimitInterval 600    <--default
$imjournalRatelimitInterval 300
$imjournalRatelimitBurst 30000

journal corruption

journalctl --verify
journalctl --force

Popular posts from this blog

Password Policy in RHEL 7

Centos 7 pulseaudio

EFF Announces Voting Registration Service