<div dir="ltr"><div><div><div><div><div><div><div>Hello,<br><br></div>I'm running into an issue where we're fairly certain that we're dropping log messages somewhere along this path:<br><br></div>device -> network -> VMware -> RHEL host -> syslog-ng<br>
<br></div>What I'd like to understand better is what statistics I can gather from syslog-ng itself to help show or rule out drops in the software. I'm using the following general config:<br><br>syslog-ng 3.2.5<br>
Installer-Version: 3.2.5<br>Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.2#master#9d4bea28198bd731df1a61e980a2af5b88d81116<br>Compile-Date: Jan 15 2012 19:47:30<br>Enable-Threads: on<br>
Enable-Debug: off<br>Enable-GProf: off<br>Enable-Memtrace: off<br>Enable-Sun-STREAMS: off<br>Enable-IPv6: on<br>Enable-Spoof-Source: on<br>Enable-TCP-Wrapper: on<br>Enable-SSL: off<br>Enable-SQL: on<br>Enable-Linux-Caps: off<br>
Enable-Pcre: on<br>Enable-Pacct: off<br><br>options {<br> flush_lines (100);<br> time_reopen (2);<br> log_iw_size(100);<br> log_fifo_size (65536);<br> log_msg_size(8192);<br> long_hostnames (off);<br>
use_dns(yes);<br> use_fqdn(yes);<br> keep_hostname (no);<br> stats_freq(3600);<br> stats_level(1);<br> dns_cache(yes);<br> keep_timestamp(no);<br>};<br><br></div>When I looked at "syslog-ng-ctl stats" I see these "types"<br>
<br>dropped<br>processed<br>stamp<br>stored<br><br></div>However I only see "dropped" counters for tcp destinations, and not for any of the sources or local destinations. Does "dropped" only make sense in the remote destination case? Is there anything I can turn on/examine to tune my syslog-ng performance and verify whether I have drops occurring within syslog-ng?<br>
<br></div>For the RHEL host portion I've tried watching netstat -su and netstat -st but the error counters for those do not seem to indicate that the level of issue we're seeing lies there. The processor for syslog-ng is busy, but averages 75%...<br>
<br></div>Is it foolish to expect VMware to keep up with the level of logs we're taking in? Might virtualization be hiding drops from me?<br><br>Any help appreciated...<br><br>Cheers,<br><br>Jesse<br clear="all"><div>
<div><div><div><div><div><div><div><br>-- <br>Jesse Bowling<br><br>
</div></div></div></div></div></div></div></div></div>