Pages

2.25.2013

RSYSLOG: Disable Rate-limiting

This is a quick post about a security mechanism that was being a pain-in-the-arse so like any good SA I just disabled it.

I was consistently receiving this message in /var/log/messages when trying to fix a configuration issue with snort:
rsyslogd-2177: imuxsock begins to drop messages from pid 12490 due to rate-limiting

To allow any process unlimited logging to syslog add the following line to /etc/rsyslog.conf:
$SystemLogRateLimitInterval 0

Then to restart the service (on Centos/RHEL/Fedora) run:
service rsyslog restart

No comments:

Post a Comment