In 7.3.2, to be released today, I reworked ratelimiting and “last message repeated n times” handling – all over rsyslog code. Each of the supported inputs now supports linux-like ratelimiting (formerly only imuxsock did). Also, the “last message repeated n times” is now processed at the input side and no longer at the output side of rsyslog processing. This provides the basis for new future additons as well as usually more performance and a much simpler output part, which can be even further refactored. I kept away from refactoring that part of the code as I think the change was already large enough and I’d like to get some practical feedback on that version first.
Of course, the input side now has become a bit more complex, but this offers great new abilities. Most importantly, the “last message repeated n times” is finally a bit useful at all, because the repeat message detection now happens on a per-input basis. Previously, messages from different inputs were mixed and as such repeat messages from a single input could not reliably be detected and prevented. That was a design limitation stemming back from the original handling. It finally was time to remove that limitation.
Please note that we now also support linux-type ratelimiting, usually via the two parameters “ratelimit.burst” and “ratelimit.interval”. The “ratelimit.burst” specifies how many messages can be emitted at most in the period specified by “ratelimit.interval” (in seconds). Any excess messages are discarded (the idea of just delaying them is floating around, but this is not yet implemented – but fairly easy to do…). At the end of the interval, the whole processing is restarted. This mode is MUCH faster than “last message repeated n times” but of course does not just reduce similiar messages.
A concrete example for imudp looks like this:
input(type="imudp" port="514"
ratelimit.burst="5000" ratelimit.interval="2")
This allows at most 5,000 messages within 2 seconds.