<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2900.3527" name=GENERATOR></HEAD>
<BODY>
<DIV dir=ltr align=left><SPAN class=763105615-17062009><FONT face=Arial
color=#0000ff size=2>Knee jerk reaction: are you using udp? You probably know
that udp is a connection-less, fire-and-forget protocol so if the
packet gets lost neither the sender nor the intended recipent will know (or
care).</FONT></SPAN></DIV><BR>
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> syslog-ng-bounces@lists.balabit.hu
[mailto:syslog-ng-bounces@lists.balabit.hu] <B>On Behalf Of </B>Aaron
Robel<BR><B>Sent:</B> 17 June 2009 16:20<BR><B>To:</B>
syslog-ng@lists.balabit.hu<BR><B>Subject:</B> [syslog-ng] Syslog-ng 3.0.2
statistics<BR></FONT><BR></DIV>
<DIV></DIV>
<DIV>Hello,</DIV>
<DIV> </DIV>
<DIV>My apologies in advance, this is my first posting and I'm quite the
rook' when it comes to Linux and Syslog-ng. I keep wondering why this is my
project.</DIV>
<DIV> </DIV>
<DIV>I have a 4 server syslog deployment with 3 front end "relay" boxes and 1
backend archive box all within a virtualized SLES environment.</DIV>
<DIV> </DIV>
<DIV>Recently I noticed that the relay's together are averaging about 2500
messages per second (mps). The majority of the messages are coming
from a single relay, about 2000 mps. Yet the archive box is only averaging about
400 mps.</DIV>
<DIV> </DIV>
<DIV>Since we are running 3.0.2 I decided to turn up the stats_level to
(1). I don't see any drops to the about 150 file destinations
that I've built.</DIV>
<DIV> </DIV>
<DIV>What does stamp, processed, stored, etc.. mean? I couldn't find any
detailed documentation about the different statistics. </DIV>
<DIV> </DIV>
<DIV>Why am I getting such a large discrepency between "stamp" and
"processed" in the log stats?</DIV>
<DIV> </DIV>
<DIV>Finally, since I'm sending the email does anyone see an issue with the
way I've got the flow control set up in the global options?</DIV>
<DIV> </DIV>
<DIV>Here are my stats in question off my archive box:</DIV>
<DIV>processed='src.udp(s_network#0)=22020892',
<BR>stamp='src.udp(s_network#0)=1245249328'</DIV>
<DIV> </DIV>
<DIV>Here's the global's off the archive box:</DIV>
<DIV>options {<BR>
time_sleep(10);<BR>
log_fetch_limit(250);<BR>
log_fifo_size(2000);<BR>
use_dns(no);<BR>
keep_timestamp(yes);<BR>
dns_cache(no);<BR>
long_hostnames(off);<BR>
flush_lines(2000);<BR>
flush_timeout(200);<BR>
perm(0644);<BR>
stats_freq(1800);<BR>
stats_level(1);<BR>
time_reopen(10);<BR>
create_dirs(yes);<BR>
dir_perm(755);<BR>};<BR clear=all></DIV>
<DIV></DIV>
<DIV>Thanks!</DIV>
<DIV> </DIV></BODY></HTML>