My apologies to Matthew and Martin. I did not intend to jump in and take over the thread. I just wanted to make Matthew and other Solaris 10 syslog-ng users aware that there is a recent kernel patch to address UDP issues. The patch number is 144488-11. It is a Kernel patch so you might as well apply the latest Recommended Patches, as it is included in that patch set.<br>
<br>I will take Matthew's good suggestion and check out the loggen utility. I was not aware that it existed and am going to look for the documentation as soon as I hit Send.<br><br>I will also open up a separate thread to avoid any confusion:))<br>
<br><br><br><div class="gmail_quote">On Sat, Apr 16, 2011 at 11:25 PM, Martin Holste <span dir="ltr"><<a href="mailto:mcholste@gmail.com">mcholste@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
Shot in the dark: have you checked to be sure there aren't checksum<br>
errors in the packets? Some kernels will drop bad checksummed<br>
packets.<br>
<div><div></div><div class="h5"><br>
On Fri, Apr 15, 2011 at 8:27 PM, Fred Connolly <<a href="mailto:fred.connolly@gmail.com">fred.connolly@gmail.com</a>> wrote:<br>
> I am experiencing the same problem with Sun V490 except the server has about<br>
> 16gb memory. We are using UDP and losing about 85% of the traffic. The<br>
> udpinoverflows is darn near equal to the total number of packets coming in.<br>
> I am not at work now so cannot provide accurate statistics at this time. The<br>
> NIC statistics are perfect, we aren't getting any errors with regards to the<br>
> UDP area etc.<br>
><br>
> There is a kernel patch that came out about a week or two ago that deals in<br>
> this area, but I have not yet applied it. I want to apply the patch first<br>
> before adjusting other kernel parameters. We have Solaris 10, update 9.<br>
> Version of syslog-ng is 3.1.2. It is really terrible.<br>
><br>
> By terrible, I mean the packet loss, not the product:)) It is probably<br>
> something I don't have set up correctly.<br>
><br>
> Mike, check out that latest patch, it can't hurt. I had to open a case with<br>
> Sun to find out about it:))<br>
><br>
><br>
><br>
> On Fri, Apr 15, 2011 at 3:45 PM, Matthew Hall <<a href="mailto:mhall@mhcomputing.net">mhall@mhcomputing.net</a>> wrote:<br>
>><br>
>> On Fri, Apr 15, 2011 at 02:01:50PM -0400, Mishou Michael wrote:<br>
>> > I left out the resources I have to work with on this system, and how<br>
>> > bad/good things are with syslog-ng running (and dropping), I'll include<br>
>> > those now. As you can see, it's an older server, but it has a ton of<br>
>> > RAM and the CPUs should have enough pop for this I think.<br>
>><br>
>> > I'm just not sure what to do next to troubleshoot. I'm hoping someone<br>
>> > here can point me in the right direction, or at least confirm that they<br>
>> > are running syslog-ng in a similar configuration without drops so I know<br>
>> > that it's at least possible?<br>
>> ><br>
>> > Regards,<br>
>> ><br>
>> > --Mike<br>
>><br>
>> I think the next suspect would be the disks. Can you disable anything that<br>
>> writes to disk or tell it to write to /dev/null and see if it still blows<br>
>> up?<br>
>><br>
>> Also, it's Solaris, so you could start using some of the dtrace scripts to<br>
>> look for what syscalls / other ops are running too slow, and when it gets<br>
>> stuck what type of socket / disk file / what IO is it doing?<br>
>><br>
>> Matthew.<br>
>><br>
>> ______________________________________________________________________________<br>
>> Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
>> Documentation:<br>
>> <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
>> FAQ: <a href="http://www.campin.net/syslog-ng/faq.html" target="_blank">http://www.campin.net/syslog-ng/faq.html</a><br>
>><br>
><br>
><br>
> ______________________________________________________________________________<br>
> Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
> Documentation:<br>
> <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
> FAQ: <a href="http://www.campin.net/syslog-ng/faq.html" target="_blank">http://www.campin.net/syslog-ng/faq.html</a><br>
><br>
><br>
><br>
</div></div></blockquote></div><br>