ratelimit Object#

New in version 8.2602.0.

The ratelimit object allows defining named rate limit policies that can be reused across multiple inputs. This is particularly useful for applying a consistent policy to a group of listeners or for managing rate limits centrally.

Parameters#

name#

type	required	default
string	yes	none

The name of the rate limit policy. This name is used to reference the policy from input modules (e.g., via RateLimit.Name="policyName").

interval#

type	required	default
integer	no	0

The interval (in seconds) for the rate limit. Messages exceeding the burst limit within this interval are dropped. A value of 0 disables rate limiting.

burst#

type	required	default
integer	no	10000

The maximum number of messages allowed within the interval.

perSource#

type	required	default
boolean	no	off

Enable per-source rate limiting using an external YAML policy.

perSourcePolicy#

type	required	default
string	no	none

Path to the YAML file that defines per-source limits. Required when perSource is on. The YAML file must define a default block with max and window values and may optionally include overrides keyed by exact sender values.

default:
  max: 1000
  window: 10s
overrides:
  - key: "db01.corp.local"
    max: 5000
    window: 10s

perSourceKeyTpl#

type	required	default
string	no	RSYSLOG_PerSourceKey

Template that computes the per-source key. The default template is equivalent to %hostname%.

perSourceMaxStates#

type	required	default
integer	no	10000

Upper bound on the number of tracked sender keys for per-source limits. When the cap is reached, least-recently-used sender state is evicted.

perSourceTopN#

type	required	default
integer	no	10

Number of per-source drop counters to expose in statistics output (top-N by drops).

Example#

# Define a strict rate limit for public facing ports
ratelimit(name="strict" interval="1" burst="50")

# Define per-source policy for TCP inputs
ratelimit(name="per_source"
          perSource="on"
          perSourcePolicy="/etc/rsyslog/imtcp-ratelimits.yaml"
          perSourceKeyTpl="PerSourceKey")

# Apply it to a TCP listener
input(type="imtcp" port="10514" rateLimit.Name="strict")

# Apply it to a Plain TCP listener
input(type="imptcp" port="10515" rateLimit.Name="strict")

# Apply per-source limits to a TCP listener
input(type="imtcp" port="10516" rateLimit.Name="per_source")

Per-source key examples#

# Key by IP address
template(name="PerSourceIP" type="string" string="%fromhost-ip%")
ratelimit(name="per_source_ip"
          perSource="on"
          perSourcePolicy="/etc/rsyslog/imtcp-ratelimits.yaml"
          perSourceKeyTpl="PerSourceIP")
input(type="imtcp" port="514" rateLimit.Name="per_source_ip")

# Key by hostname (default)
template(name="PerSourceHost" type="string" string="%hostname%")
ratelimit(name="per_source_host"
          perSource="on"
          perSourcePolicy="/etc/rsyslog/imtcp-ratelimits.yaml"
          perSourceKeyTpl="PerSourceHost")
input(type="imtcp" port="514" rateLimit.Name="per_source_host")

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project