Rsyslog: discarding specific messages, rate limiting

rsyslog

I've got netatalk installed on the server and afpd is spamming system logs with the following error:

Jun 24 15:38:16 TEST afpd[21532]: sys_getextattr_size: error: Operation not supported

I'm not sure what's the actual root cause for this so I tried to discard this error message by adding the following line into rsyslog.conf config file:

if ($programname == 'afpd') then ~

It's no longer logged but it looks like afpd is still logging a lot:

Jun 24 15:46:31 TEST rsyslogd-2177: imuxsock lost 13 messages from pid 35381 due to rate-limiting
Jun 24 15:46:31 TEST rsyslogd-2177: imuxsock begins to drop messages from pid 34080 due to rate-limiting

The 35381 and 34080 are afpd PIDs.

When I disabled the rate limiting ($SystemLogRateLimitInterval 0) the messages are no longer logged so I'm not quite sure what's going on there.

Questions:

  • why messages are not logged when rate limiting is disabled
  • how I can permanently discard logs from afpd daemon

Edit: Wed Jul 2 14:41:34 BST 2014:

  • System: CentOS release 6.4
  • rsyslog-5.8.10-6.el6.x86_64

Default configuration, I just added this line if ($programname == 'afpd') then ~ to rsyslog.conf config file.

Best Answer

may be offtopic, but

When I disabled the rate limiting ($SystemLogRateLimitInterval 0) the messages are no longer logged so I'm not quite sure what's going on there.

need more parameters to disable rsyslog limit https://access.redhat.com/solutions/156863

$SystemLogRateLimitInterval 0
$SystemLogRateLimitBurst 0
$IMUXSockRateLimitBurst 0
$IMUXSockRateLimitInterval 0
$IMUXSockRateLimitSeverity 7
Related Topic