<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="generator" content="Osso Notes">
<title></title></head>
<body>
<p>----- Original message -----
<br>> Thanks for your reply
<br>> How can I understand when it's enough to increase things? Is there any
<br>> manual way to get current values of each buffer, etc?
<br>
<br>well, I tend to use loggen for performance tests, also you can query syslog-ng internal statistics using 'syslog-ng-ctl stats'
<br>
<br>> Also since I'm logging a lot of things I'd love to know if there are some
<br>> other ways to lose messages without seeing them in "dropped"?
<br>
<br>syslog-ng counts everything it dropped using the dropped counters for destinations (which is a log-fifo overflow btw)
<br>
<br>messages can be lost outside syslog-ng because of transport reasons:
<br>  * udp shouldn't be used for anything serious.
<br>  * connection breaks can cause message loss
<br>
<br>
<br>>
<br>> > In general, performance wise you want to increase stuff
<br>> > (log-fetch-limit,
<br>> log-iw-size, flush-lines for file destinations), memory-use and
<br>> reliability wise you want to decrease them.
<br>> > Also, you have to make sure that sum(log-iw-size) < log-fifo-size.
<br>> So you propose just randomly tune those params? I just don't understand
<br>> how should I get check if it helped.
<br>
<br>no :) random tuning would be slow to converge to the ideal values.
<br>
<br>
<br>
<br>I need to see the current state of
<br>> each buffer(to be able to get some statistics data) to see if it helps.
<br>
<br>syslog-ng-ctl stats displays the current values of statistics as a csv file.
<br>
<br>also you can ask syslog-ng to measure more stats by increasing stats-level (at the cost of some performance)
<br>
<br>>
<br>> And one more specific question:
<br>> > If flow-control is in use and one of the destinations cannot accept the
<br>> messages, the other destinations do not receive any messages either,
<br>> because syslog-ng stops reading the source.
<br>
<br>this is not true. syslog-ng stops sources individually when their window is full.
<br>
<br>> Why there is no messages about it in syslog-ng logs? It must be error,
<br>> don't you think so?
<br>> And what if I don't have flow-control enabled?
<br><br></p>
</body>
</html>