<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.0.6618.4">
<TITLE>syslog-ng 2.0rc1 memory usage</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P><FONT SIZE=2 FACE="Arial">Anyone running 2.0rc1 on Solaris 9 (sparc)?</FONT>
<BR><FONT SIZE=2 FACE="Arial">If so, what memory requirements are you seeing for the syslog-ng process?</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">My install handles ~ 700 messages/sec (all UDP) and over the course of a day syslog-ng will gradually consume nearly all available free memory (I've seen it up to 1GB).</FONT></P>
<P><FONT SIZE=2 FACE="Arial">(syslog-ng is bounced by logrotate daily, so the process repeats itself)</FONT>
<BR><FONT SIZE=2 FACE="Arial">I was able to substantially decrease the rate of consumption by adding the 'flush_lines" global (syslog-ng process now at 91MB and growing ... slowly).</FONT></P>
<P><FONT SIZE=2 FACE="Arial">I installed 2.0rc1 on one server, kept another at 1.6.8 (roughly 500 messages/sec load). The syslog-ng process there is stable at 3 MB.</FONT></P>
<P><FONT SIZE=2 FACE="Arial">Here's the config from the 2.0rc1 server:</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">options {</FONT>
<BR><FONT SIZE=2 FACE="Arial"> log_fifo_size(8192);</FONT>
<BR><FONT SIZE=2 FACE="Arial"> flush_lines(4096);</FONT>
<BR><FONT SIZE=2 FACE="Arial"> long_hostnames(off);</FONT>
<BR><FONT SIZE=2 FACE="Arial"> use_dns(yes);</FONT>
<BR><FONT SIZE=2 FACE="Arial"> use_fqdn(no);</FONT>
<BR><FONT SIZE=2 FACE="Arial"> create_dirs(no);</FONT>
<BR><FONT SIZE=2 FACE="Arial">};</FONT>
<BR><FONT SIZE=2 FACE="Arial">source network {</FONT>
<BR><FONT SIZE=2 FACE="Arial"> udp();</FONT>
<BR><FONT SIZE=2 FACE="Arial">};</FONT>
<BR><FONT SIZE=2 FACE="Arial">filter f_messages {</FONT>
<BR><FONT SIZE=2 FACE="Arial"> level(info..warn) and not facility(auth);</FONT>
<BR><FONT SIZE=2 FACE="Arial">};</FONT>
<BR><FONT SIZE=2 FACE="Arial">destination messages {</FONT>
<BR><FONT SIZE=2 FACE="Arial"> file("/var/log/messages");</FONT>
<BR><FONT SIZE=2 FACE="Arial">};</FONT>
<BR><FONT SIZE=2 FACE="Arial">log {</FONT>
<BR><FONT SIZE=2 FACE="Arial"> source(network);</FONT>
<BR><FONT SIZE=2 FACE="Arial"> filter(f_messages);</FONT>
<BR><FONT SIZE=2 FACE="Arial"> destination(messages);</FONT>
<BR><FONT SIZE=2 FACE="Arial">};</FONT>
</P>
<BR>
<P><FONT SIZE=2 FACE="Arial">syslog-ng 1.6.8 config identical except for options section:</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">options {</FONT>
<BR><FONT SIZE=2 FACE="Arial"> use_fqdn(no);</FONT>
<BR><FONT SIZE=2 FACE="Arial"> keep_hostname(no);</FONT>
<BR><FONT SIZE=2 FACE="Arial"> use_dns(yes);</FONT>
<BR><FONT SIZE=2 FACE="Arial"> long_hostnames(off);</FONT>
<BR><FONT SIZE=2 FACE="Arial"> sync(0);</FONT>
<BR><FONT SIZE=2 FACE="Arial"> log_fifo_size(1000);</FONT>
<BR><FONT SIZE=2 FACE="Arial">};</FONT>
</P>
</BODY>
</HTML>
<pre>The information transmitted (including attachments) is
covered by the Electronic Communications Privacy Act,
18 U.S.C. 2510-2521, is intended only for the person(s) or
entity/entities to which it is addressed and may contain
confidential and/or privileged material. Any review,
retransmission, dissemination or other use of, or taking
of any action in reliance upon, this information by persons
or entities other than the intended recipient(s) is prohibited.
If you received this in error, please contact the sender and
delete the material from any computer.