<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:p="urn:schemas-microsoft-com:office:powerpoint" xmlns:a="urn:schemas-microsoft-com:office:access" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:s="uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882" xmlns:rs="urn:schemas-microsoft-com:rowset" xmlns:z="#RowsetSchema" xmlns:b="urn:schemas-microsoft-com:office:publisher" xmlns:ss="urn:schemas-microsoft-com:office:spreadsheet" xmlns:c="urn:schemas-microsoft-com:office:component:spreadsheet" xmlns:oa="urn:schemas-microsoft-com:office:activation" xmlns:html="http://www.w3.org/TR/REC-html40" xmlns:q="http://schemas.xmlsoap.org/soap/envelope/" xmlns:D="DAV:" xmlns:x2="http://schemas.microsoft.com/office/excel/2003/xml" xmlns:ois="http://schemas.microsoft.com/sharepoint/soap/ois/" xmlns:dir="http://schemas.microsoft.com/sharepoint/soap/directory/" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:dsp="http://schemas.microsoft.com/sharepoint/dsp" xmlns:udc="http://schemas.microsoft.com/data/udc" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:sps="http://schemas.microsoft.com/sharepoint/soap/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:udcxf="http://schemas.microsoft.com/data/udc/xmlfile" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
/* List Definitions */
@list l0
{mso-list-id:726681733;
mso-list-type:hybrid;
mso-list-template-ids:-903430892 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:.75in;
text-indent:-.25in;
font-family:Symbol;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal>Folks,<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>I’m a newbie to syslog-ng. Everything is working
in my environment, running 2.0.8. But, when I try to stress the server I
drop messages.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>I’m running from another physical server:<o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Courier New"'>./loggen -D -s 111
-r 2000 -I 1 <hostname> 514 ; date<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Courier New"'>average rate =
1818.00 msg/sec, count=<span style='color:red'>1818</span><o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Courier New"'>Thu Mar 6
18:07:17 MST 2008<o:p></o:p></span></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>The syslog-ng server is in a Solaris 10 non-global zone; my
auth.info is going to /var/adm/ssh_DAY.log. <o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Courier New"'>date ; tail
/var/adm/ssh_06.log | awk '/runid/ {print $9}' | sort -u | xargs -i egrep {}
/var/adm/ssh_06.log | wc -l<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Courier New"'>Thu Mar 6
18:07:23 MST 2008<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Courier New"'> <span
style='color:red'>1233<o:p></o:p></span></span></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>So, I’m dropping packets. I’ve stopped
syslog-ng and started standard syslog. Syslog logs all my messages to the
file when using a rate of 2000/sec. As you can from above, in my
syslog-ng environment I lose about a 3<sup>rd</sup>. When I use a rate of
1000/sec, it is not quite as bad, but I do drop a significant amount of
messages.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>I’ve read: <a
href="http://www.l3jane.net/doc/server/syslog-ng/#tuning">http://www.l3jane.net/doc/server/syslog-ng/#tuning</a>
<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>I’ve toyed with <o:p></o:p></p>
<p class=MsoNormal style='text-indent:.5in'><span style='font-family:"Courier New"'>log_fifo_size
(using values like 1000, 5000, 10000, 50000)<o:p></o:p></span></p>
<p class=MsoNormal style='text-indent:.5in'><span style='font-family:"Courier New"'>log_fetch_limit
(using values like 100, 200, 2000)<o:p></o:p></span></p>
<p class=MsoNormal style='text-indent:.5in'><span style='font-family:"Courier New"'>sync
(using values like 20, 40, 50, 100)<o:p></o:p></span></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>I have “<span style='font-family:"Courier New"'>use_dns
(no)”</span> – turning that off first. Also, I commented out
all but two sources, the one filter, the one log line.<o:p></o:p></p>
<p class=MsoNormal><span style='font-family:"Courier New"'>source s_ip148 { udp
(ip(<x>.<y>.<z>.148)); }; <o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Courier New"'>source s_ip248 { udp
(ip(<x>.<y>.<z>.248)); }; <o:p></o:p></span></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><x>, <y>, <z> are obviously replace in our
environment with the octets for the subnet.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Before trying standard syslog, I was running snoop in my
global zone to ensure all the UDP packets were arriving. The count always
matched the count shown by loggen. <o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Since I can see all the messages with standard syslog in
this Sol 10 non-global zone, I’ve ruled out:<o:p></o:p></p>
<p class=MsoListParagraph style='margin-left:.75in;text-indent:-.25in;
mso-list:l0 level1 lfo1'><![if !supportLists]><span style='font-family:Symbol'><span
style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'>
</span></span></span><![endif]>the zone being an issue.<o:p></o:p></p>
<p class=MsoListParagraph style='margin-left:.75in;text-indent:-.25in;
mso-list:l0 level1 lfo1'><![if !supportLists]><span style='font-family:Symbol'><span
style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'>
</span></span></span><![endif]>UDP tuning for the Solaris 10 host.<o:p></o:p></p>
<p class=MsoListParagraph style='margin-left:.75in;text-indent:-.25in;
mso-list:l0 level1 lfo1'><![if !supportLists]><span style='font-family:Symbol'><span
style='mso-list:Ignore'>·<span style='font:7.0pt "Times New Roman"'>
</span></span></span><![endif]>The internal hard drive i/o speed from being an
issue.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Looking at the log messages, I’m not hitting some cap
(e.g. 1233) and then not logging any more. Random gaps (both of frequency
and size) are seen throughout.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Can someone give me some pointers?<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Thanks in advance,<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Jim<o:p></o:p></p>
</div>
</body>
</html>