<div dir="ltr"><div><div>Hi,<br><br></div>270 is not a lot unless there's some kind of bottleneck in the syslog-ng side. DNS is often a culprit, that's why syslog-ng has a DNS cache which should address the problem. Do you have any kind of related settings in your configuration.<br><br></div>Also, 3.1 is pretty old, can you perhaps upgrade that to something more recent? I think squeeze is supported by the <a href="http://madhouse.org">madhouse.org</a> packages.<br><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Apr 3, 2015 at 11:53 PM, Matt Zagrabelny <span dir="ltr"><<a href="mailto:mzagrabe@d.umn.edu" target="_blank">mzagrabe@d.umn.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Greetings list!<br>
<br>
Using syslog-ng 3.1 with Debian Squeeze, 2.6.32-5-amd64. The system<br>
has 8GB of RAM.<br>
<br>
I'm losing some UDP logs. I know to not use UDP - we use TLS for our<br>
Debian systems, but our Cisco gear leaves us with few options.<br>
<br>
According to netstat, the rate is anywhere from 600 to 3000 UDP errors<br>
per second. Using a tcpdump query of "dst port 514" show about the<br>
same rate of UDP traffic coming to the system.<br>
<br>
I've bumped the buffer size according to various docs:<br>
$ head -n -0 /proc/sys/net/core/[rw]mem_*<br>
==> /proc/sys/net/core/rmem_default <==<br>
16777216<br>
<br>
==> /proc/sys/net/core/rmem_max <==<br>
16777216<br>
<br>
==> /proc/sys/net/core/wmem_default <==<br>
16777216<br>
<br>
==> /proc/sys/net/core/wmem_max <==<br>
16777216<br>
<br>
And the udp specific memory limits:<br>
<br>
$ head -n -0 /proc/sys/net/ipv4/*udp*<br>
==> /proc/sys/net/ipv4/udp_mem <==<br>
768384 1024512 1536768<br>
<br>
==> /proc/sys/net/ipv4/udp_rmem_min <==<br>
16777216<br>
<br>
==> /proc/sys/net/ipv4/udp_wmem_min <==<br>
16777216<br>
<br>
My UDP source for syslog-ng is also using a larger buffer:<br>
<br>
$ grep -A4 -B1 'udp(' /etc/syslog-ng/syslog-ng.conf<br>
source s_udp {<br>
udp(<br>
keep_hostname(yes)<br>
so_rcvbuf(16777216)<br>
);<br>
};<br>
<br>
According to syslog-ng-ctl stats the system is processing ~270 UDP<br>
messages per second. This hasn't really changed since I've made the<br>
kernel variable tweaks, nor after changing the so_rcvbuf size either.<br>
<br>
Any ideas of what to look for next?<br>
<br>
Thanks!<br>
<br>
-m<br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature">Bazsi</div>
</div>