<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
well if you are inserting into a database the database is your
bottleneck <br>
it looks like some of messages are being dropped by syslog-ng itself
and some in the udp transit.<br>
the majority being dropped by syslog-ng itself. you can increase the
log_fifo_size to reduce the drops but it wont increase the database
insert rate it will just give you a bigger buffer to handle traffic
spikes. your best bet is to tune the database to get a faster insert
rate. also disabling the atime on the file system should help.<br>
<br>
<br>
<br>
On 3/31/2010 11:47 PM, Clayton Dukes wrote:
<blockquote
cite="mid:k2ve54865561003312047l665b2651r934c637c59d1e179@mail.gmail.com"
type="cite">Hi Folks,<br>
I'm trying to run a test to check insert rates.<br>
If I run this command:<br>
<br>
./loggen -r 5000 -D -I 10 127.0.0.1 514<br>
<br>
The output shows:<br>
average rate = 5441.60 msg/sec, count=54420, time=10.007, msg size=256,
bandwidth=1360.40 kB/sec<br>
<br>
But, my stats don't show that many messages received:<br>
<br>
syslog-ng[6660]: Log statistics; dropped=\'pipe(/dev/xconsole)=0\',
processed=\'center(queued)=24232\', processed=\'center(received)=8077,
processed=\'destination(df_logzilla)=8077\'<br>
<br>
As you can see, it sent 55k messages, but I only received 8k.<br>
Am I doing something wrong?<br>
<br>
Here are my options in the syslog-ng config:<br>
options {<br>
long_hostnames(off);<br>
log_msg_size(8192);<br>
flush_lines(1);<br>
log_fifo_size(16384);<br>
time_reopen(10);<br>
use_dns(yes);<br>
dns_cache(yes);<br>
use_fqdn(yes);<br>
keep_hostname(yes);<br>
chain_hostnames(no);<br>
perm(0644);<br>
stats_freq(60);<br>
<br>
};<br>
<br clear="all">
<br>
-- <br>
______________________________________________________________ <br>
<br>
Clayton Dukes<br>
______________________________________________________________<br>
<pre wrap="">
<fieldset class="mimeAttachmentHeader"></fieldset>
______________________________________________________________________________
Member info: <a class="moz-txt-link-freetext" href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
Documentation: <a class="moz-txt-link-freetext" href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
FAQ: <a class="moz-txt-link-freetext" href="http://www.campin.net/syslog-ng/faq.html">http://www.campin.net/syslog-ng/faq.html</a>
</pre>
</blockquote>
<br>
</body>
</html>