I’ve never been a big fan of rsyslog, preferring syslog-ng instead. However, I am giving rsyslog another chance. One of my biggest problems with rsyslog has been it’s high memory usage, documented by many people in many complaints that can be found using google. Now this emmory is usually, though not always, virtual and not resident. That means rsyslog is not actually hogging memory but merely causes reporting problems when searching for processes with high memory usage as it will often show up. However, I’m trying a new solution that I hope will improve the situation. From the rsyslog wiki:

rsylsog is a (potentially massively) multi-threaded syslogd. Each of the threads requires a runtime stack. Rsyslog uses no specific stack allocation and sticks with the OS default. Seen in practice have stack allocations of 8 to 10 MB per thread. In a process trace, this can look like a memory leak.

—Reducing memory usage

So how big is the default stack for rsyslog:

cat /proc/`pidof rsyslogd`/limits

On all of the 64-bit Ubuntu systems I’ve tested the answer is:

Max stack size 8388608 unlimited bytes

So 8MB. The easiest fix I discovered is this:

Edit /etc/default/rsyslog and add the line:

ulimit -S -s 128

This sets the soft limit for stack size to 128K. Then restart:

restart rsyslog

Then verify:

cat /proc/`pidof rsyslogd`/limits

Max stack size 131072 unlimited bytes