<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]-->
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Monaco;
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:blue;
text-decoration:underline;}
p
{mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman";}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:Arial;
color:navy;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang=EN-US link=blue vlink=blue style='word-wrap: break-word;-khtml-nbsp-mode: space;
-khtml-line-break: after-white-space'>
<div class=Section1>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Just in case:<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>If the firewall is a Cisco PIX you might
want to reconsider. If the PIX looses its ability to send TCP messages to
its loghost then it denies all traffic until loghost connectivity is restored.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<div>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>
<hr size=2 width="100%" align=center tabindex=-1>
</span></font></div>
<p class=MsoNormal><b><font size=2 face=Tahoma><span style='font-size:10.0pt;
font-family:Tahoma;font-weight:bold'>From:</span></font></b><font size=2
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'>
syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] <b><span
style='font-weight:bold'>On Behalf Of </span></b>Cary, Kim<br>
<b><span style='font-weight:bold'>Sent:</span></b> Tuesday, March 14, 2006
12:30 PM<br>
<b><span style='font-weight:bold'>To:</span></b> syslog-ng@lists.balabit.hu<br>
<b><span style='font-weight:bold'>Subject:</span></b> [syslog-ng] solaris UDP
loss</span></font><o:p></o:p></p>
</div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Finally got around to reading the docs and applying the
recommendations.<o:p></o:p></span></font></p>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>FIRST - thanks much!<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>NOW - my results:<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'># ndd /dev/udp udp_recv_hiwat<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>65536<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'># ndd /dev/udp udp_max_buf<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>1073741824<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'># date ; netstat -s | grep udpInOverflows<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Tue Mar 14 10:15:16<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> udpInCksumErrs =
0 udpInOverflows =677996405<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'># date ; netstat -s | grep udpInOverflows<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Tue Mar 14 10:15:19<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> udpInCksumErrs =
0 udpInOverflows =677996571<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'># date ; netstat -s | grep udpInOverflows<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Tue Mar 14 10:15:22<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> udpInCksumErrs =
0 udpInOverflows =677996726<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>I'm pretty sure this is just the Firewall sending more than 55M lines
of connection/deny logs over UDP.<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>IF I was to switch the FW over to TCP logging from UDP, would this be a
better solution?<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>BTW, here are a few words from syslog-ng:<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Mar 14 09:32:32 syslog-ng[20685]: STATS: dropped 0<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Mar 14 09:42:32 syslog-ng[20685]: STATS: dropped 0<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Mar 14 09:52:32 syslog-ng[20685]: STATS: dropped 0<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Mar 14 10:02:32 syslog-ng[20685]: STATS: dropped 0<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Mar 14 10:04:53 syslog-ng[20685]: Garbage collecting while busy...<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Mar 14 10:04:58 syslog-ng[20685]: Objects alive: 310, garbage
collected: 2999695<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Mar 14 10:12:32 syslog-ng[20685]: STATS: dropped 0<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Mar 14 10:16:22 syslog-ng[20685]: Garbage collecting while idle...<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Mar 14 10:16:24 syslog-ng[20685]: Objects alive: 318, garbage
collected: 1129970<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Mar 14 10:22:32 syslog-ng[20685]: STATS: dropped 0<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>and its config:<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>source s_udp_inetpix { <o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>
udp(ip(192.168.0.1)); <o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> };<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>On Mar 7, 2006, at 3:01 PM, <a
href="mailto:syslog-ng-request@lists.balabit.hu">syslog-ng-request@lists.balabit.hu</a>
wrote:<o:p></o:p></span></font></p>
</div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><br>
<br>
<o:p></o:p></span></font></p>
<p style='margin:0in;margin-bottom:.0001pt'><font size=1 face=Monaco><span
style='font-size:7.5pt;font-family:Monaco'>| 1) Am I reading that loss right??</span></font><o:p></o:p></p>
<p style='margin:0in;margin-bottom:.0001pt;min-height: 14.0px'><font size=1
face=Monaco><span style='font-size:7.5pt;font-family:Monaco'><o:p> </o:p></span></font></p>
<p style='margin:0in;margin-bottom:.0001pt'><font size=1 face=Monaco><span
style='font-size:7.5pt;font-family:Monaco'>Probably, you might<span
class=apple-converted-space> </span>however want to snoop on the
interface to see what</span></font><o:p></o:p></p>
<p style='margin:0in;margin-bottom:.0001pt'><font size=1 face=Monaco><span
style='font-size:7.5pt;font-family:Monaco'>kind of udp packets come on your
interface.</span></font><o:p></o:p></p>
<p style='margin:0in;margin-bottom:.0001pt;min-height: 14.0px'><font size=1
face=Monaco><span style='font-size:7.5pt;font-family:Monaco'><o:p> </o:p></span></font></p>
<p style='margin:0in;margin-bottom:.0001pt'><font size=1 face=Monaco><span
style='font-size:7.5pt;font-family:Monaco'>| 2) Any tips from Solaris/syslog-ng
tuners would be appreciated!</span></font><o:p></o:p></p>
<p style='margin:0in;margin-bottom:.0001pt;min-height: 14.0px'><font size=1
face=Monaco><span style='font-size:7.5pt;font-family:Monaco'><o:p> </o:p></span></font></p>
<p style='margin:0in;margin-bottom:.0001pt'><font size=1 face=Monaco><span
style='font-size:7.5pt;font-family:Monaco'>udp_max_buf does not set the queue
length of the udp socket, which by</span></font><o:p></o:p></p>
<p style='margin:0in;margin-bottom:.0001pt'><font size=1 face=Monaco><span
style='font-size:7.5pt;font-family:Monaco'>the way can have a different value
for each socket...</span></font><o:p></o:p></p>
<p style='margin:0in;margin-bottom:.0001pt;min-height: 14.0px'><font size=1
face=Monaco><span style='font-size:7.5pt;font-family:Monaco'><o:p> </o:p></span></font></p>
<p style='margin:0in;margin-bottom:.0001pt'><font size=1 face=Monaco><span
style='font-size:7.5pt;font-family:Monaco'>You could have a look at:</span></font><o:p></o:p></p>
<p style='margin:0in;margin-bottom:.0001pt'><font size=1 face=Monaco><span
style='font-size:7.5pt;font-family:Monaco'><a
href="http://sunsolve.sun.com/search/document.do?assetkey=1-30-3218-1">http://sunsolve.sun.com/search/document.do?assetkey=1-30-3218-1</a></span></font><o:p></o:p></p>
<p style='margin:0in;margin-bottom:.0001pt;min-height: 14.0px'><font size=1
face=Monaco><span style='font-size:7.5pt;font-family:Monaco'><o:p> </o:p></span></font></p>
<p style='margin:0in;margin-bottom:.0001pt'><font size=1 face=Monaco><span
style='font-size:7.5pt;font-family:Monaco'>basically: increasing udp_max_buf
without increasing udp_recv_hiwat has</span></font><o:p></o:p></p>
<p style='margin:0in;margin-bottom:.0001pt'><font size=1 face=Monaco><span
style='font-size:7.5pt;font-family:Monaco'>no meaning. Furthermore, you can
increase you socket buffer that way up</span></font><o:p></o:p></p>
<p style='margin:0in;margin-bottom:.0001pt'><font size=1 face=Monaco><span
style='font-size:7.5pt;font-family:Monaco'>to 64k (Solaris 8 & 9), if you
want to increase it</span></font><o:p></o:p></p>
<p style='margin:0in;margin-bottom:.0001pt'><font size=1 face=Monaco><span
style='font-size:7.5pt;font-family:Monaco'>further up you must use the
setsockopt call (up to udp_max_buf which</span></font><o:p></o:p></p>
<p style='margin:0in;margin-bottom:.0001pt'><font size=1 face=Monaco><span
style='font-size:7.5pt;font-family:Monaco'>has a maximum value of 1GB).<span
class=apple-converted-space> </span></span></font><o:p></o:p></p>
<p style='margin:0in;margin-bottom:.0001pt'><font size=1 face=Monaco><span
style='font-size:7.5pt;font-family:Monaco'>Here is the official SUN
documentation regarding this:</span></font><o:p></o:p></p>
<p style='margin:0in;margin-bottom:.0001pt'><font size=1 face=Monaco><span
style='font-size:7.5pt;font-family:Monaco'><a
href="http://docs.sun.com/app/docs/doc/817-0404/6mg74vsb5?a=view#gbtag">http://docs.sun.com/app/docs/doc/817-0404/6mg74vsb5?a=view#gbtag</a></span></font><o:p></o:p></p>
<p style='margin:0in;margin-bottom:.0001pt;min-height: 14.0px'><font size=1
face=Monaco><span style='font-size:7.5pt;font-family:Monaco'><o:p> </o:p></span></font></p>
<p style='margin:0in;margin-bottom:.0001pt'><font size=1 face=Monaco><span
style='font-size:7.5pt;font-family:Monaco'>Now regarding your packet loss
issue. I would increase</span></font><o:p></o:p></p>
<p style='margin:0in;margin-bottom:.0001pt'><font size=1 face=Monaco><span
style='font-size:7.5pt;font-family:Monaco'>udp_recv_hiwat -> 65536</span></font><o:p></o:p></p>
<p style='margin:0in;margin-bottom:.0001pt'><font size=1 face=Monaco><span
style='font-size:7.5pt;font-family:Monaco'>udp_max_buf -> 1073741824 (you
will never get here anyway)</span></font><o:p></o:p></p>
<p style='margin:0in;margin-bottom:.0001pt;min-height: 14.0px'><font size=1
face=Monaco><span style='font-size:7.5pt;font-family:Monaco'><o:p> </o:p></span></font></p>
<p style='margin:0in;margin-bottom:.0001pt'><font size=1 face=Monaco><span
style='font-size:7.5pt;font-family:Monaco'>Then I would try to play with
syslog-ng config: log_fifo_size,</span></font><o:p></o:p></p>
<p style='margin:0in;margin-bottom:.0001pt'><font size=1 face=Monaco><span
style='font-size:7.5pt;font-family:Monaco'>log_iw_size and log_fetch_limit.<span
class=apple-converted-space> </span>But here I'd appreciate</span></font><o:p></o:p></p>
<p style='margin:0in;margin-bottom:.0001pt'><font size=1 face=Monaco><span
style='font-size:7.5pt;font-family:Monaco'>a syslog-ng expert to step in and
tell us what to do more preceisely.</span></font><o:p></o:p></p>
</div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
</div>
</div>
<br><br><table bgcolor=white style="color:black"><tr><td><br><br>
This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.<br>
</td></tr></table></body>
</html>