Hi,
We have upgraded around 80 SLES12-SP3 to SLES12-SP4 and it has worked well on all but two servers. These two are dedicated rsyslog servers which collect logs from a large environment. All the server run rsyslog, but the rest only for local logging.
What happens is that that rsyslog stops responding on port 514, and seems to refuse to accept the logs. We monitor the port with Nagios, and can see that it is flapping between OK and error. It feels like it has to do with the volume of logs, since we haven´t seen this except on the dedicated log servers.
I “solved” the problem by installing the last 4.4 kernel from SP3, and the problem went away.
Anyone else seen this ? Could i be some kernel parameter that has changed between 4.4 and 4.12 ?