<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="generator" content="Osso Notes">
<title></title></head>
<body>
<p>----- Original message -----
<br>> Thanks Daniel. I'm already using "syslog-ng-ctl stats" with different
<br>> stats levels. I'm just confused with "center()":
<br>> *% sudo syslog-ng-ctl stats | grep center
<br>>
<br>>  *
<br>> *center;;received;a;processed;0*
<br>> *center;;queued;a;processed;0*
<br>
<br>center has been broken since 3.2, because there's no 'center' anymore.  IIRC I have removed that counter since then. If there's a usecase for center I may give a thought how to revive it.
<br>
<br>> *
<br>> *
<br>> Also maybe balabit guys are able to give us some information on global
<br>> stats:
<br>> *% sudo syslog-ng-ctl stats | grep global *
<br>> *global;sdata_updates;;a;processed;0*
<br>
<br>this one counts the number of 'slow' updates to structured data entries during processing. being zero means that you basically never add sdata, but either not change it at all, or only change entries that are already present.
<br>
<br>> *global;payload_reallocs;;a;processed;760*
<br>
<br>this counts the number of reallocs of the message payload. syslog-ng sizes the allocated buffer with a simple heuristics in the hope that parsing, rewrite rules will not cause it to grow. in your case syslog-ng had to do a realloc for 760 messages. if this happens to be close to all messages you processed, it's the cause for performance degradation.
<br>
<br>if it's a minority then you probably don't have to care.
<br>
<br>if the first one is true, I'd like to know about it.
<br>
<br>right now the alllocated size is twice the length of the incoming message.
<br>
<br>
<br>> *global;msg_clones;;a;processed;0*
<br>>
<br>
<br>again a performance monitoring counter, that tracks the number of clone operations.
<br>
<br>>
<br>> On Thu, Dec 27, 2012 at 6:07 PM, Daniel Neubacher
<br>> <<a href="mailto:daniel.neubacher@xing.com">daniel.neubacher@xing.com</a>
<br>> > wrote:
<br>>
<br>> > I guess u need „syslog-ng-ctl stats”.  But u need to configure
<br>> > “stats_level(2);” in your options to get this running nicely.****
<br>> >
<br>> > And if you want to get logs per second I’ve attached my little bash
<br>> > script: ****
<br>> >
<br>> > #!/bin/bash****
<br>> >
<br>> > ** **
<br>> >
<br>> > while true****
<br>> >
<br>> > do ****
<br>> >
<br>> > for i in $(syslog-ng-ctl stats | grep src.tcp | grep proc |
<br>> > cut -d ";" -f6) ****
<br>> >
<br>> > do ****
<br>> >
<br>> > let tc1+=$i ****
<br>> >
<br>> > done ****
<br>> >
<br>> > let lps=tc1-tc2****
<br>> >
<br>> > test -z $tc2 || echo $lps****
<br>> >
<br>> > tc2=$tc1****
<br>> >
<br>> > tc1=0****
<br>> >
<br>> > sleep 1****
<br>> >
<br>> > done****
<br>> >
<br>> > ** **
<br>> >
<br>> > *Von:* <a href="mailto:syslog-ng-bounces@lists.balabit.hu">syslog-ng-bounces@lists.balabit.hu</a> [mailto:
<br>> > <a href="mailto:syslog-ng-bounces@lists.balabit.hu">syslog-ng-bounces@lists.balabit.hu</a>] *Im Auftrag von *Anton Koldaev
<br>> > *Gesendet:* Donnerstag, 27. Dezember 2012 10:18
<br>> > *An:* Syslog-ng users' and developers' mailing list
<br>> > *Betreff:* [syslog-ng] Statistics summary****
<br>> >
<br>> > ** **
<br>> >
<br>> > Is there a nice way to get total numbers of processed/stored/dropped
<br>> > messages in syslog-ng v3.3?****
<br>> >
<br>> > ** **
<br>> >
<br>> > From docs:****
<br>> >
<br>> > > The *center(received)* entry shows the total number of messages
<br>> > received from every configured sources.
<br>> > ****
<br>> >
<br>> > ** **
<br>> >
<br>> > But in my stats center() shows zero almost for every host. I see zero
<br>> > in some other examples in docs too.****
<br>> >
<br>> > ** **
<br>> >
<br>> > --
<br>> > Best regards,
<br>> > Koldaev Anton ****
<br>> >
<br>> >
<br>> > ______________________________________________________________________________
<br>> > Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
<br>> > Documentation:
<br>> > <a href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a>
<br>> > FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a>
<br>> >
<br>> >
<br>> >
<br>>
<br>>
<br>> --
<br>> Best regards,
<br>> Koldaev Anton
<br><br></p>
</body>
</html>