<div class="im" style="font-family:arial,sans-serif;font-size:13px">> > > If flow-control is in use and one of the destinations cannot accept the <br>> > messages, the other destinations do not receive any messages either, <br>
> > because syslog-ng stops reading the source. <br><br></div><span style="font-family:arial,sans-serif;font-size:13px">> this is not true. syslog-ng stops sources individually when their window is full.</span><br>
<div><span style="font-family:arial,sans-serif;font-size:13px"><br></span></div><div><span style="font-family:arial,sans-serif;font-size:13px">But it's a quote from </span><font face="arial, sans-serif"><a href="http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.3-guides/syslog-ng-ose-v3.3-guide-admin-en.html/index.html-single.html#id555527">http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.3-guides/syslog-ng-ose-v3.3-guide-admin-en.html/index.html-single.html#id555527</a> </font></div>
<div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Nov 5, 2012 at 9:34 AM, Balazs Scheidler <span dir="ltr"><<a href="mailto:bazsi77@gmail.com" target="_blank">bazsi77@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><u></u>
<div>
<p></p><div class="im">----- Original message -----
<br>> Thanks for your reply
<br>> How can I understand when it's enough to increase things? Is there any
<br>> manual way to get current values of each buffer, etc?
<br>
<br></div>well, I tend to use loggen for performance tests, also you can query syslog-ng internal statistics using 'syslog-ng-ctl stats'
<br><div class="im">
<br>> Also since I'm logging a lot of things I'd love to know if there are some
<br>> other ways to lose messages without seeing them in "dropped"?
<br>
<br></div>syslog-ng counts everything it dropped using the dropped counters for destinations (which is a log-fifo overflow btw)
<br>
<br>messages can be lost outside syslog-ng because of transport reasons:
<br> * udp shouldn't be used for anything serious.
<br> * connection breaks can cause message loss
<br><div class="im">
<br>
<br>>
<br>> > In general, performance wise you want to increase stuff
<br>> > (log-fetch-limit,
<br>> log-iw-size, flush-lines for file destinations), memory-use and
<br>> reliability wise you want to decrease them.
<br>> > Also, you have to make sure that sum(log-iw-size) < log-fifo-size.
<br>> So you propose just randomly tune those params? I just don't understand
<br>> how should I get check if it helped.
<br>
<br></div>no :) random tuning would be slow to converge to the ideal values.
<br><div class="im">
<br>
<br>
<br>I need to see the current state of
<br>> each buffer(to be able to get some statistics data) to see if it helps.
<br>
<br></div>syslog-ng-ctl stats displays the current values of statistics as a csv file.
<br>
<br>also you can ask syslog-ng to measure more stats by increasing stats-level (at the cost of some performance)
<br><div class="im">
<br>>
<br>> And one more specific question:
<br>> > If flow-control is in use and one of the destinations cannot accept the
<br>> messages, the other destinations do not receive any messages either,
<br>> because syslog-ng stops reading the source.
<br>
<br></div>this is not true. syslog-ng stops sources individually when their window is full.
<br><div class="im">
<br>> Why there is no messages about it in syslog-ng logs? It must be error,
<br>> don't you think so?
<br>> And what if I don't have flow-control enabled?
<br><br></div><p></p>
</div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br>Best regards,<br>Koldaev Anton<br>
</div>