Hi All,<br><br>NEED HELP!!!!!<br><br>[Environment]<br>SunOS 5.9 Generic_122300-07 sun4u sparc SUNW<br>syslog-ng 2.0.4<br>disk : single disk (no RAID)<br>syslog-ng conf (global option part)<br> sync (3000);<br> time_reopen (10);
<br> time_sleep(0);<br> log_fifo_size (10000);<br> long_hostnames (off);<br> use_dns (no);<br> use_fqdn (no);<br> create_dirs (no);<br> keep_hostname (yes);<br>
<br>[NEED]<br>I want syslog-ng to write logs to local disk at pace of about 4000<br>lines per second without any lines losing.<br>However, lines were in fact lost in the local file.<br>I am trying to know the syslog-ng max performable point.
<br><br>[Consideration]<br>"log_fifo_size" in global option is set as 10000.<br>I tried to set sync() parameter, for instance 3000, in global option section.<br>This did not succeed with this messages when reloading the process,
<br>" The value of flush_lines must be less than fifo_size; fifo_size='1000',<br>flush_lines='3000' ".<br>The administration guide says "sync" is alias for "flush_lines".<br><br>
In addition, resource usage at 4000lines/s load was as below,<br><br>result of vmstat<br> kthr memory page disk faults cpu<br> r b w swap free re mf pi po fr de sr s3 sd sd -- in sy cs us sy id
<br> 0 0 0 3954792 3895288 155 8 353 0 0 0 12 0 2 0 0 669 4368 857 4 3 93<br> 0 0 0 3955248 3926424 3 8 0 0 0 0 0 0 2 0 0 4112 27017 5889 21 15 64<br> 0 0 0 3955248 3925664 0 0 0 0 0 0 0 0 3 0 0 4120 27251 5653 16 19 64
<br> 0 0 0 3955248 3924528 0 0 0 0 0 0 0 0 1 0 0 4129 27251 5914 15 18 67<br> 0 0 0 3955248 3923400 0 0 0 0 0 0 0 0 1 0 0 4113 27236 6052 17 15 68<br> 0 0 0 3955176 3922568 0 0 0 0 0 0 0 0 32 0 0 4156 26028 5405 19 13 68
<br> 0 0 0 3955176 3921808 0 0 0 0 0 0 0 0 1 0 0 4161 27316 5757 16 18 66<br> 0 0 0 3955176 3921056 0 0 0 0 0 0 0 0 1 0 0 4120 27254 6136 14 18 68<br> 0 0 0 3955176 3920296 0 0 0 0 0 0 0 0 1 0 0 4110 27244 5648 18 17 65
<br> 0 0 0 3955176 3919544 0 0 0 0 0 0 0 0 1 0 0 4115 27253 6042 17 19 64<br> 0 0 0 3955176 3918784 0 0 0 0 0 0 0 0 1 0 0 4108 27238 6469 18 16 65<br> 0 0 0 3955176 3918032 0 0 0 0 0 0 0 0 1 0 0 4107 27235 6106 16 18 66
<br> 0 0 0 3955176 3917272 0 0 0 0 0 0 0 0 1 0 0 4139 27264 5850 17 18 65<br> 0 0 0 3955176 3916520 0 0 0 0 0 0 0 0 1 0 0 4107 27259 5867 19 14 67<br><br>result of iostat<br> extended device statistics
<br> r/s w/s kr/s kw/s wait actv wsvc_t asvc_t %w %b device<br> 0.0 1.0 0.0 775.9 0.0 0.0 0.0 27.3 0 3 c1t0d0s3<br> 1.0 2.0 8.0 744.1 0.0 0.0 0.0 11.4 0 3 c1t0d0s3<br>
0.0 2.0 0.0 864.0 0.0 0.0 0.0 15.7 0 3 c1t0d0s3<br> 0.0 4.0 0.0 856.0 0.0 0.1 0.0 17.3 0 3 c1t0d0s3<br> 0.0 1.0 0.0 456.0 0.0 0.0 0.0 19.5 0 2 c1t0d0s3<br>
0.0 1.0 0.0 856.1 0.0 0.0 0.0 28.1 0 3 c1t0d0s3<br> 0.0 1.0 0.0 855.9 0.0 0.0 0.0 24.4 0 2 c1t0d0s3<br> 0.0 1.0 0.0 856.1 0.0 0.0 0.0 27.3 0 3 c1t0d0s3<br> 0.0
0.0 0.0 0.0 0.0 0.0 0.0 0.0 0 0 c1t0d0s3<br> 0.0 1.0 0.0 856.0 0.0 0.0 0.0 19.0 0 2 c1t0d0s3<br> 0.0 1.0 0.0 856.0 0.0 0.0 0.0 26.9 0 3 c1t0d0s3<br> 0.0
1.0 0.0 832.1 0.0 0.0 0.0 24.8 0 2 c1t0d0s3<br> 0.0 1.0 0.0 735.9 0.0 0.0 0.0 26.4 0 3 c1t0d0s3<br> 0.0 1.0 0.0 856.1 0.0 0.0 0.0 28.7 0 3 c1t0d0s3<br> 0.0 0.0
0.0 0.0 0.0 0.0 0.0 0.0 0 0 c1t0d0s3<br><br>[Question]<br>Question 1.<br> Does the "fifo_size" in above message mean "log_fifo_size" in global<br> option ?<br> Is the value "fifo_size='1000'" max value ?
<br> Is it possible to set "log_fifo_size" far more than 1000 ?<br> Is it possible to set "sync" far more than 1000 ?<br> If possible, then how do I do it ?<br><br>Question 2.<br> To achieve the NEED, I am considering the parameters below,
<br> sync()<br> log_fifo_size()<br> .<br> Are there any other parameters I MUST consider for syslog-ng<br> configuration?<br><br>Regards<br><br>George