rsyslogd内存占用很高解决方案

阿里云虚拟服务器（ECS）,内存告警，通过top查看内存使用情况如下：

image.png

处理方法：
1、通过top -c可知，/usr/sbin/rsyslogd -n 占用了大量内存。
查看rsyslogd服务配置文件,内存上限设置为8M，然后将绝对内存限制为80M

[root@iZbp10jpji0rlgveoewg4sZ ~]# cat /usr/lib/systemd/system/rsyslog.service
[Unit]
Description=System Logging Service
;Requires=syslog.socket
Wants=network.target network-online.target
After=network.target network-online.target
Documentation=man:rsyslogd(8)
Documentation=http://www.rsyslog.com/doc/

[Service]
Type=notify
EnvironmentFile=-/etc/sysconfig/rsyslog
ExecStart=/usr/sbin/rsyslogd -n $SYSLOGD_OPTIONS
Restart=on-failure
UMask=0066
StandardOutput=null
Restart=on-failure

MemoryAccounting=yes
MemoryMax=80M
MemoryHigh=8M


[Install]
WantedBy=multi-user.target
;Alias=syslog.service

2、查看rsyslog 服务,
可以看到目前内存使用量：Memory: 841.2M，超过了80M的限制。

[root@iZbp10g4sZ ~]# systemctl status rsyslog
● rsyslog.service - System Logging Service
   Loaded: loaded (/usr/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
   Active: active (running) since Mon 2023-12-04 13:48:43 CST; 1 months 1 days ago
     Docs: man:rsyslogd(8)
           http://www.rsyslog.com/doc/
 Main PID: 12692 (rsyslogd)
    Tasks: 3
   Memory: 841.2M
   CGroup: /system.slice/rsyslog.service
           └─12692 /usr/sbin/rsyslogd -n


Jan 05 13:51:29 iZbp10jpji0rlgveoewg4sZ rsyslogd[12692]: imjournal: begin to drop messages due to rate-limiting
Jan 05 13:53:47 iZbp10jpji0rlgveoewg4sZ rsyslogd[12692]: imjournal: 5367 messages lost due to rate-limiting
Jan 05 14:01:46 iZbp10jpji0rlgveoewg4sZ rsyslogd[12692]: imjournal: begin to drop messages due to rate-limiting
Jan 05 14:03:48 iZbp10jpji0rlgveoewg4sZ rsyslogd[12692]: imjournal: 5102 messages lost due to rate-limiting

3、重启rsyslog服务器，释放内存：
systemctl restart rsyslog