概述使用top命令查看内存占用时，发现rsyslogd内存占用很高。处理方法1直接重启rsyslog服务 释放内存systemctl restart rsyslog处理方法2某些rsyslog旧版本会存在内存泄露问题，故对系统rsyslog服务进行升级，并重启yum install rsyslog -y systemctl restart rsyslog处理方法3还有一种更稳妥的方案，直接修改rsyslogd服务启动文件，通过systemd限制rsyslog内存使用。vim /usr/lib/systemd/system/rsyslog.service在Service配置中添加MemoryAccounting=yes，MemoryMax=80M，MemoryHigh=8M三项来限制服务内存使用率，如下所示[Unit] Description=System Logging Service ;Requires=syslog.socket Wants=network.target network-online.target After=network.target network-online.target Documentation=man:rsyslogd(8) Documentation=http://www.rsyslog.com/doc/ [Service] Type=notify EnvironmentFile=-/etc/sysconfig/rsyslog ExecStart=/usr/sbin/rsyslogd -n $SYSLOGD_OPTIONS Restart=on-failure UMask=0066 StandardOutput=null Restart=on-failure MemoryAccounting=yes MemoryMax=80M MemoryHigh=8M [Install] WantedBy=multi-user.target ;Alias=syslog.service通常情况下rsyslogd大小只有5M，所以将内存上限设置为8M，然后将绝对内存限制为80M。重启服务systemctl daemon-reload systemctl restart rsyslog根本原因查看rsyslog输出的日志/var/log/路径描述/var/log/messages服务信息日志(记录linux操作系统常见的服务信息和错误信息)/var/log/secure系统的登陆日志(记录用户和工作组的变化情况,是系统安全日志，用户的认证登陆情况/var/log/maillog邮件日志/var/log/cron定时任务/var/log/boot.log系统启动日志发现/var/log/messages有几个G的日志。查看日志内容发现rsyslog把Journal的log都进行了输出和汇总。当容器越多是，log也就会也多，内存占用也就越多。同时也可能导致systemd-journald进程内存占用过高我们可以消减输出的日志，将log级别定义为err级别修改rsyslogd配置文件/etc/rsyslog.conf*.err;mail.none;authpriv.none;cron.none /var/log/messages 重启服务systemctl daemon-reload systemctl restart rsyslog 修改Journal的配置/etc/systemd/journald.conf把Storage改为persistent，如下# This file is part of systemd. # # systemd is free software; you can redistribute it and/or modify it # under the terms of the GNU Lesser General Public License as published by # the Free Software Foundation; either version 2.1 of the License, or # (at your option) any later version. # # Entries in this file show the compile time defaults. # You can change settings by editing this file. # Defaults can be restored by simply deleting this file. # # See journald.conf(5) for details. [Journal] Storage=persistent #Compress=yes #Seal=yes #SplitMode=uid #SyncIntervalSec=5m #RateLimitInterval=30s #RateLimitBurst=1000 SystemMaxUse=1G #SystemKeepFree= SystemMaxFileSize=10M #RuntimeMaxUse= #RuntimeKeepFree= #RuntimeMaxFileSize= MaxRetentionSec=1month #MaxFileSec=1month ForwardToSyslog=no #ForwardToKMsg=no #ForwardToConsole=no ForwardToWall=no #TTYPath=/dev/console #MaxLevelStore=debug #MaxLevelSyslog=debug #MaxLevelKMsg=notice #MaxLevelConsole=info #MaxLevelWall=emerg #LineMax=48K 重启服务systemctl restart systemd-journald Storage选项通过查看man手册，#man 5 journald.conf 你会发现，Storage=的值可以是volatile,persistent,auto,none，但是，默认的是auto，volatile代表日志只存在内存中，即/run/log/journal/persistent代表日志只存在磁盘中，即/var/log/journal/auto代表日志存在磁盘中，或者内存中，取决于你是否创建/var/log/journal/目录，部分系统是需要手动mkdir -p /var/log/journal/，systemctl restart systemd-journald来解放内存。none，表示，日志不保留，全部drop，当你决定不使用systemd-journald的时候，你可以使用。