April 2015 - syslog-ng - lists.balabit.hu

UDP errors and lost UDP messages
by Matt Zagrabelny 07 Apr '15

07 Apr '15

Greetings list! Using syslog-ng 3.1 with Debian Squeeze, 2.6.32-5-amd64. The system has 8GB of RAM. I'm losing some UDP logs. I know to not use UDP - we use TLS for our Debian systems, but our Cisco gear leaves us with few options. According to netstat, the rate is anywhere from 600 to 3000 UDP errors per second. Using a tcpdump query of "dst port 514" show about the same rate of UDP traffic coming to the system. I've bumped the buffer size according to various docs: $ head -n -0 /proc/sys/net/core/[rw]mem_* ==> /proc/sys/net/core/rmem_default <== 16777216 ==> /proc/sys/net/core/rmem_max <== 16777216 ==> /proc/sys/net/core/wmem_default <== 16777216 ==> /proc/sys/net/core/wmem_max <== 16777216 And the udp specific memory limits: $ head -n -0 /proc/sys/net/ipv4/*udp* ==> /proc/sys/net/ipv4/udp_mem <== 768384 1024512 1536768 ==> /proc/sys/net/ipv4/udp_rmem_min <== 16777216 ==> /proc/sys/net/ipv4/udp_wmem_min <== 16777216 My UDP source for syslog-ng is also using a larger buffer: $ grep -A4 -B1 'udp(' /etc/syslog-ng/syslog-ng.conf source s_udp { udp( keep_hostname(yes) so_rcvbuf(16777216) ); }; According to syslog-ng-ctl stats the system is processing ~270 UDP messages per second. This hasn't really changed since I've made the kernel variable tweaks, nor after changing the so_rcvbuf size either. Any ideas of what to look for next? Thanks! -m

3 4

so_rcvbuf default value of 0
by Matt Zagrabelny 07 Apr '15

07 Apr '15

Greetings, Just looking for confirmation about the so_rcvbuf parameter for the udp() source driver. The default is 0. Does that mean that syslog-ng uses the default value from the kernel? ie. cat /proc/sys/net/core/rmem_default 124928 If that is true, then perhaps the syslog-ng admin docs could mention that. I've scanned "man 7 socket" and don't seen anything that suggests that a value of 0 for so_rcvbuf means that the socket will inherit the value. Thanks for the help! -m

2 2

Compiling Github Source (not Balabit source)
by Asadullah Hussain 03 Apr '15

03 Apr '15

Hello, I have recently started exploring the syslog source with plan of contributing in future. I am able to run syslog using the source from Balabit site. But is there a way to compile the Github source? I have tried using Autoconf/Autoscan to generate the configure files but without success. I just have future pull requests in mind as Github source and Balabit source differ in a few files). -- Cheers, Asad

3 4

Re: [syslog-ng] Compiling Github Source (not Balabit source)
by Laszlo Budai 03 Apr '15

03 Apr '15

Hi Asad, I've created a docker image which can helps you: https://registry.hub.docker.com/u/lbudai/docker-syslog-ng-build-env/ L. Sent from my HTC ----- Reply message ----- From: "Asadullah Hussain" <asadxflow(a)gmail.com> To: <syslog-ng(a)lists.balabit.hu> Subject: [syslog-ng] Compiling Github Source (not Balabit source) Date: Thu, Apr 2, 2015 11:33 Hello, I have recently started exploring the syslog source with plan of contributing in future. I am able to run syslog using the source from Balabit site. But is there a way to compile the Github source? I have tried using Autoconf/Autoscan to generate the configure files but without success. I just have future pull requests in mind as Github source and Balabit source differ in a few files). -- Cheers, Asad ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq

1 0

Re: [syslog-ng] Compiling Github Source (not Balabit source) (Asadullah Hussain)
by Anshul Kushwaha 02 Apr '15

02 Apr '15

Hi Asad, You can try running autoconf ./autogen.sh ./configure make make install for compiling from the github source. This worked well for me. If there are errors while running autoconf, try posting them here or on irc. Regards, Anshul Kushwaha

1 0