91Linux - journal
type: channel
link: https://91linux.org/tag/journal/
items: 解决rsyslogd服务占用内存高

解决rsyslogd服务占用内存高
type: item
date: 2020-04-23T15:52:00+08:00
description: 概述使用top命令查看内存占用时，发现rsyslogd内存占用很高。处理方法1直接重启rsyslog服务 释放内存systemctl restart rsyslog处理方法2某些rsyslog旧版本会存在内存泄露问题，故对系统rsyslog服务进行升级，并重启yum install rsyslog -y systemctl restart rsyslog处理方法3还有一种更稳妥的方案，直接修改rsyslogd服务启动文件，通过systemd限制rsyslog内存使用。vim /usr/lib/systemd/system/rsyslog.service在Service配置中添加MemoryAccounting=yes，MemoryMax=80M，MemoryHigh=8M三项来限制服务内存使用率，如下所示[Unit] Description=System Logging Service ;Requires=syslog.socket Wants=network.target network-online.target After=network.target network-online.target Documentation=man:rsyslogd(8) Documentation=http://www.rsyslog.com/doc/ [Service] Type=notify EnvironmentFile=-/etc/sysconfig/rsyslog ExecStart=/usr/sbin/rsyslogd -n $SYSLOGD_OPTIONS Restart=on-failure UMask=0066 StandardOutput=null Restart=on-failure MemoryAccounting=yes MemoryMax=80M MemoryHigh=8M [Install] WantedBy=multi-user.target ;Alias=syslog.service通常情况下rsyslogd大小只有5M，所以将内存上限设置为8M，然后将绝对内存限制为80M。重启服务systemctl daemon-reload systemctl restart rsyslog根本原因查看rsyslog输出的日志/var/log/路径描述/var/log/messages服务信息日志(记录linux操作系统常见的服务信息和错误信息)/var/log/secure系统的登陆日志(记录用户和工作组的变化情况,是系统安全日志，用户的认证登陆情况/var/log/maillog邮件日志/var/log/cron定时任务/var/log/boot.log系统启动日志发现/var/log/messages有几个G的日志。查看日志内容发现rsyslog把Journal的log都进行了输出和汇总。当容器越多是，log也就会也多，内存占用也就越多。同时也可能导致systemd-journald进程内存占用过高我们可以消减输出的日志，将log级别定义为err级别修改rsyslogd配置文件/etc/rsyslog.conf*.err;mail.none;authpriv.none;cron.none /var/log/messages 重启服务systemctl daemon-reload systemctl restart rsyslog 修改Journal的配置/etc/systemd/journald.conf把Storage改为persistent，如下# This file is part of systemd. # # systemd is free software; you can redistribute it and/or modify it # under the terms of the GNU Lesser General Public License as published by # the Free Software Foundation; either version 2.1 of the License, or # (at your option) any later version. # # Entries in this file show the compile time defaults. # You can change settings by editing this file. # Defaults can be restored by simply deleting this file. # # See journald.conf(5) for details. [Jo…