<HTML><BODY style="word-wrap: break-word; -khtml-nbsp-mode: space; -khtml-line-break: after-white-space; ">Finally got around to reading the docs and applying the recommendations.<DIV><BR class="khtml-block-placeholder"></DIV><DIV>FIRST - thanks much!</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>NOW - my results:</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV># ndd /dev/udp udp_recv_hiwat</DIV><DIV>65536</DIV><DIV># ndd /dev/udp udp_max_buf</DIV><DIV>1073741824</DIV><DIV># date ; netstat -s | grep udpInOverflows</DIV><DIV>Tue Mar 14 10:15:16</DIV><DIV> udpInCksumErrs = 0 udpInOverflows =677996405</DIV><DIV># date ; netstat -s | grep udpInOverflows</DIV><DIV>Tue Mar 14 10:15:19</DIV><DIV> udpInCksumErrs = 0 udpInOverflows =677996571</DIV><DIV># date ; netstat -s | grep udpInOverflows</DIV><DIV>Tue Mar 14 10:15:22</DIV><DIV> udpInCksumErrs = 0 udpInOverflows =677996726</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>I'm pretty sure this is just the Firewall sending more than 55M lines of connection/deny logs over UDP.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>IF I was to switch the FW over to TCP logging from UDP, would this be a better solution?</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>BTW, here are a few words from syslog-ng:</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>Mar 14 09:32:32 syslog-ng[20685]: STATS: dropped 0</DIV><DIV>Mar 14 09:42:32 syslog-ng[20685]: STATS: dropped 0</DIV><DIV>Mar 14 09:52:32 syslog-ng[20685]: STATS: dropped 0</DIV><DIV>Mar 14 10:02:32 syslog-ng[20685]: STATS: dropped 0</DIV><DIV>Mar 14 10:04:53 syslog-ng[20685]: Garbage collecting while busy...</DIV><DIV>Mar 14 10:04:58 syslog-ng[20685]: Objects alive: 310, garbage collected: 2999695</DIV><DIV>Mar 14 10:12:32 syslog-ng[20685]: STATS: dropped 0</DIV><DIV>Mar 14 10:16:22 syslog-ng[20685]: Garbage collecting while idle...</DIV><DIV>Mar 14 10:16:24 syslog-ng[20685]: Objects alive: 318, garbage collected: 1129970</DIV><DIV>Mar 14 10:22:32 syslog-ng[20685]: STATS: dropped 0</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>and its config:</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>source s_udp_inetpix { </DIV><DIV> udp(ip(192.168.0.1)); </DIV><DIV> };</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV><BR><DIV><DIV>On Mar 7, 2006, at 3:01 PM, <A href="mailto:syslog-ng-request@lists.balabit.hu">syslog-ng-request@lists.balabit.hu</A> wrote:</DIV><BR class="Apple-interchange-newline"><BLOCKQUOTE type="cite"><P style="margin: 0.0px 0.0px 0.0px 0.0px"><FONT face="Monaco" size="2" style="font: 10.0px Monaco">| 1) Am I reading that loss right??</FONT></P> <P style="margin: 0.0px 0.0px 0.0px 0.0px; font: 10.0px Monaco; min-height: 14.0px"><BR></P> <P style="margin: 0.0px 0.0px 0.0px 0.0px"><FONT face="Monaco" size="2" style="font: 10.0px Monaco">Probably, you might<SPAN class="Apple-converted-space"> </SPAN>however want to snoop on the interface to see what</FONT></P> <P style="margin: 0.0px 0.0px 0.0px 0.0px"><FONT face="Monaco" size="2" style="font: 10.0px Monaco">kind of udp packets come on your interface.</FONT></P> <P style="margin: 0.0px 0.0px 0.0px 0.0px; font: 10.0px Monaco; min-height: 14.0px"><BR></P> <P style="margin: 0.0px 0.0px 0.0px 0.0px"><FONT face="Monaco" size="2" style="font: 10.0px Monaco">| 2) Any tips from Solaris/syslog-ng tuners would be appreciated!</FONT></P> <P style="margin: 0.0px 0.0px 0.0px 0.0px; font: 10.0px Monaco; min-height: 14.0px"><BR></P> <P style="margin: 0.0px 0.0px 0.0px 0.0px"><FONT face="Monaco" size="2" style="font: 10.0px Monaco">udp_max_buf does not set the queue length of the udp socket, which by</FONT></P> <P style="margin: 0.0px 0.0px 0.0px 0.0px"><FONT face="Monaco" size="2" style="font: 10.0px Monaco">the way can have a different value for each socket...</FONT></P> <P style="margin: 0.0px 0.0px 0.0px 0.0px; font: 10.0px Monaco; min-height: 14.0px"><BR></P> <P style="margin: 0.0px 0.0px 0.0px 0.0px"><FONT face="Monaco" size="2" style="font: 10.0px Monaco">You could have a look at:</FONT></P> <P style="margin: 0.0px 0.0px 0.0px 0.0px"><FONT face="Monaco" size="2" style="font: 10.0px Monaco"><A href="http://sunsolve.sun.com/search/document.do?assetkey=1-30-3218-1">http://sunsolve.sun.com/search/document.do?assetkey=1-30-3218-1</A></FONT></P> <P style="margin: 0.0px 0.0px 0.0px 0.0px; font: 10.0px Monaco; min-height: 14.0px"><BR></P> <P style="margin: 0.0px 0.0px 0.0px 0.0px"><FONT face="Monaco" size="2" style="font: 10.0px Monaco">basically: increasing udp_max_buf without increasing udp_recv_hiwat has</FONT></P> <P style="margin: 0.0px 0.0px 0.0px 0.0px"><FONT face="Monaco" size="2" style="font: 10.0px Monaco">no meaning. Furthermore, you can increase you socket buffer that way up</FONT></P> <P style="margin: 0.0px 0.0px 0.0px 0.0px"><FONT face="Monaco" size="2" style="font: 10.0px Monaco">to 64k (Solaris 8 & 9), if you want to increase it</FONT></P> <P style="margin: 0.0px 0.0px 0.0px 0.0px"><FONT face="Monaco" size="2" style="font: 10.0px Monaco">further up you must use the setsockopt call (up to udp_max_buf which</FONT></P> <P style="margin: 0.0px 0.0px 0.0px 0.0px"><FONT face="Monaco" size="2" style="font: 10.0px Monaco">has a maximum value of 1GB).<SPAN class="Apple-converted-space"> </SPAN></FONT></P> <P style="margin: 0.0px 0.0px 0.0px 0.0px"><FONT face="Monaco" size="2" style="font: 10.0px Monaco">Here is the official SUN documentation regarding this:</FONT></P> <P style="margin: 0.0px 0.0px 0.0px 0.0px"><FONT face="Monaco" size="2" style="font: 10.0px Monaco"><A href="http://docs.sun.com/app/docs/doc/817-0404/6mg74vsb5?a=view#gbtag">http://docs.sun.com/app/docs/doc/817-0404/6mg74vsb5?a=view#gbtag</A></FONT></P> <P style="margin: 0.0px 0.0px 0.0px 0.0px; font: 10.0px Monaco; min-height: 14.0px"><BR></P> <P style="margin: 0.0px 0.0px 0.0px 0.0px"><FONT face="Monaco" size="2" style="font: 10.0px Monaco">Now regarding your packet loss issue. I would increase</FONT></P> <P style="margin: 0.0px 0.0px 0.0px 0.0px"><FONT face="Monaco" size="2" style="font: 10.0px Monaco">udp_recv_hiwat -> 65536</FONT></P> <P style="margin: 0.0px 0.0px 0.0px 0.0px"><FONT face="Monaco" size="2" style="font: 10.0px Monaco">udp_max_buf -> 1073741824 (you will never get here anyway)</FONT></P> <P style="margin: 0.0px 0.0px 0.0px 0.0px; font: 10.0px Monaco; min-height: 14.0px"><BR></P> <P style="margin: 0.0px 0.0px 0.0px 0.0px"><FONT face="Monaco" size="2" style="font: 10.0px Monaco">Then I would try to play with syslog-ng config: log_fifo_size,</FONT></P> <P style="margin: 0.0px 0.0px 0.0px 0.0px"><FONT face="Monaco" size="2" style="font: 10.0px Monaco">log_iw_size and log_fetch_limit.<SPAN class="Apple-converted-space"> </SPAN>But here I'd appreciate</FONT></P> <P style="margin: 0.0px 0.0px 0.0px 0.0px"><FONT face="Monaco" size="2" style="font: 10.0px Monaco">a syslog-ng expert to step in and tell us what to do more preceisely.</FONT></P> </BLOCKQUOTE></DIV><BR></DIV></BODY></HTML>