I am experiencing the same problem with Sun V490 except the server has about 16gb memory. We are using UDP and losing about 85% of the traffic. The udpinoverflows is darn near equal to the total number of packets coming in. I am not at work now so cannot provide accurate statistics at this time. The NIC statistics are perfect, we aren't getting any errors with regards to the UDP area etc.<br>
<br>There is a kernel patch that came out about a week or two ago that deals in this area, but I have not yet applied it. I want to apply the patch first before adjusting other kernel parameters. We have Solaris 10, update 9. Version of syslog-ng is 3.1.2. It is really terrible. <br>
<br>By terrible, I mean the packet loss, not the product:)) It is probably something I don't have set up correctly.<br><br>Mike, check out that latest patch, it can't hurt. I had to open a case with Sun to find out about it:))<br>
<br><br><br><div class="gmail_quote">On Fri, Apr 15, 2011 at 3:45 PM, Matthew Hall <span dir="ltr"><<a href="mailto:mhall@mhcomputing.net">mhall@mhcomputing.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div class="im">On Fri, Apr 15, 2011 at 02:01:50PM -0400, Mishou Michael wrote:<br>
> I left out the resources I have to work with on this system, and how<br>
> bad/good things are with syslog-ng running (and dropping), I'll include<br>
> those now. As you can see, it's an older server, but it has a ton of<br>
> RAM and the CPUs should have enough pop for this I think.<br>
<br>
</div><div class="im">> I'm just not sure what to do next to troubleshoot. I'm hoping someone<br>
> here can point me in the right direction, or at least confirm that they<br>
> are running syslog-ng in a similar configuration without drops so I know<br>
> that it's at least possible?<br>
><br>
> Regards,<br>
><br>
> --Mike<br>
<br>
</div>I think the next suspect would be the disks. Can you disable anything that writes to disk or tell it to write to /dev/null and see if it still blows up?<br>
<br>
Also, it's Solaris, so you could start using some of the dtrace scripts to look for what syscalls / other ops are running too slow, and when it gets stuck what type of socket / disk file / what IO is it doing?<br>
<font color="#888888"><br>
Matthew.<br>
</font><div><div></div><div class="h5">______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.campin.net/syslog-ng/faq.html" target="_blank">http://www.campin.net/syslog-ng/faq.html</a><br>
<br>
</div></div></blockquote></div><br>