Hey gurus<br>
<br>
I will try 1.9.9 again when I have more time. I tried it once and it literally killed me with stats although I had stats(0) set.<br>
It was insane so I turned it off again. As I said when I have more time
but I was wondering whether some of the log delivery probs may have to
do with oracle rac. It seems those machines are particulary bad and a <br>
netstat -ee reveals the great amount of open tcp connections used by 'oracle' for the cluster stuff.<br>
I have an average of 300 lines like this in netstat -ee:<br>
<br>
tcp
0 0
{host-vip}:1521
{host-real}:44853
ESTABLISHED oracle 1176037944<br>
<br>
the real and VIP are on the same box. my log is stuffed of the dreaded :<br>
<br>
Mar 9 18:51:26 {host} syslog-ng[29085]: Connection broken to AF_INET(localhost:5000), reopening in 10 seconds<br>
<br>
I'm thinking this box run out of sockets but I'm not too sure how to properly ts/prove that. netstat -s seems to show<br>
random drops but on all machines. <br>
Would anyone have more hints on how to check whether I have to tune the
kernel for these boxes ? Sorry but this is the first time I'm digging
that deep into the stack...<br>
<br>
PS: any chance 2.0 will include temporary message supressant code -
syslog style (the only thing I really liked about old syslog) ?<br>
<br><br><div><span class="gmail_quote">On 3/3/06, <b class="gmail_sendername">Balazs Scheidler</b> <<a href="mailto:bazsi@balabit.hu">bazsi@balabit.hu</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
On Thu, 2006-03-02 at 16:15 -0800, stucky wrote:<br>><br>> thanks for your reply ! I am already using keepalive on the server :<br>><br>> tcp (ip("**********")<br>> port(5000)<br>> max-connections(1000)
<br>> keep-alive(yes)); };<br>><br>> It doesn't look like I can specify this option on the client though.<br>> If I try something like :<br>> destination loghost { tcp("*********" port(5000) keep-alive(yes)); };
<br>><br>> It complains about a syntax error. I have never seen an option called<br>> 'tcp-keep-alive()' but I tried it without<br>> luck. It always complains about a syntax error. I guess you meant<br>> 'keep-alive(yes)' right ?
<br><br>tcp-keep-alive was added in 1.6.3 as I read my changelogs.<br><br>keep-alive and tcp-keep-alive are different beasts, the first means that<br>syslog-ng should keep all connections open through reloads, the second<br>
means to enable SO_KEEPALIVE option.<br><br>><br>> As far as upgrading is concerned I want to but I wanted to wait till<br>> 2.0 is out and stable. Any ETA ?<br><br>It all depends on testers. Judging the feedback it is either rock solid,
<br>or no-one is using it. I suspect it is the latter.<br><br>In the current situation an "it works for me" messages would help a lot,<br>the first can be this very mail, as I've been using 1.9.x snapshots for<br>
about a year now.<br><br>--<br>Bazsi<br><br>_______________________________________________<br>syslog-ng maillist - <a href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a><br><a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">
https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>Frequently asked questions at <a href="http://www.campin.net/syslog-ng/faq.html">http://www.campin.net/syslog-ng/faq.html</a><br><br></blockquote></div><br><br clear="all">
<br>-- <br>stucky