- syslog-ng - lists.balabit.hu

RE: [syslog-ng] Apache Syslog-ng/Syslog-ng newbie
by Esquivel, Vicente 22 Nov '05

22 Nov '05

Thanks for responding. So let me make sure I am understanding what you suggested. You said that I could run SnareApache on the servers running apache, then let Snare send the Apache access logs to the local syslog on that same server then have the syslogd on that server send them to the centralized syslog server that is logging via syslog-ng? So I take it that Apache can't do it any other way without something like Snare? How much of a load does it add to a server and how difficult is it to implement? Thanks! Vince ________________________________ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Brian Bemis Sent: Monday, November 21, 2005 2:39 PM To: 'Syslog-ng users' and developers' mailing list' Subject: RE: [syslog-ng] Apache Syslog-ng/Syslog-ng newbie For the error logs, logging to syslog (or syslog-ng) is built into Apache. For the access logs, try SNARE for Apache: http://www.intersectalliance.com/projects/SnareApache/index.html You can use this in conjunction with syslog-ng. It will send you're apache logs to the syslog daemon on the local system, then all you have to do it set up syslog-ng to forward the logs to a central server and separate them according to the server sending the logs. This is all built into syslog-ng. b ________________________________ From: syslog-ng-bounces(a)lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Esquivel, Vicente Sent: Monday, November 21, 2005 8:39 AM To: Syslog-ng users' and developers' mailing list Subject: [syslog-ng] Apache Syslog-ng/Syslog-ng newbie Hello all, I am new to this list, I am seeking some help on how to setup syslog-ng as a central log server. More importantly I am wanting to know how to log all of my Apache servers to the central log server, but also create separate logs for each of the systems. For example I am looking to do something like this: Apache1 /var/log/Apache1/httpd/access.log /var/log/Apache1/httpd/error.log Apache2 /var/log/Apache2/httpd/access.log /var/log/Apache2/httpd/error.log Apache3 /var/log/Apache3/httpd/access.log /var/log/Apache3/httd/error.log and so on. Thanks all in advance Vince

3 2

avoid
by Atif Munir 22 Nov '05

22 Nov '05

How can i avoid "syslog-ng[24047]: STATS: dropped 0" As there are many more messages which are being captured by the syslog-ng and are published on the web.. Thanks

1 0

Apache Syslog-ng/Syslog-ng newbie
by Esquivel, Vicente 21 Nov '05

21 Nov '05

Hello all, I am new to this list, I am seeking some help on how to setup syslog-ng as a central log server. More importantly I am wanting to know how to log all of my Apache servers to the central log server, but also create separate logs for each of the systems. For example I am looking to do something like this: Apache1 /var/log/Apache1/httpd/access.log /var/log/Apache1/httpd/error.log Apache2 /var/log/Apache2/httpd/access.log /var/log/Apache2/httpd/error.log Apache3 /var/log/Apache3/httpd/access.log /var/log/Apache3/httd/error.log and so on. Thanks all in advance Vince

2 1

syslog-ng and logwatch
by kevin_herald 17 Nov '05

17 Nov '05

Hello, Anyone use syslog-ng with logwatch-7.1? I was wondering how to set it up to scan the proper log files. Right now I have multiple servers writing to the main syslog-ng server. It creates directories such as: /var/log/HOSTS/<ip of clients>/2005/11/14/<logfile-name> logwatch.pl looks like it scans for /var/log or whatever you want, but I'm not sure how to scan the multiple directories of the syslog-ng server client logs. Thanks, Kevin

5 7

Remove informations out of the destination
by GCA-FRITZ＠web.de 16 Nov '05

16 Nov '05

Hi, I habe a question about removing the informations like Nov 16 12:40:50 xxxx.xxx.xxx.xxx logger: out of my destination file. Is there somewhere a flag in syslog-ng witch disable this information. Thx for your help. br Daniel ______________________________________________________________ Verschicken Sie romantische, coole und witzige Bilder per SMS! Jetzt bei WEB.DE FreeMail: http://f.web.de/?mc=021193

1 0

Measure throughput and events-per-second
by Scott, Joshua 15 Nov '05

15 Nov '05

Can someone provide some information or tips on how to measure the performance and usage of syslog-ng? I'm looking into purchasing some new hardware for my syslog-ng server and I want to be able to determine the average number of events-per-second/minute/etc as well as the average number of bytes written to disk per second/minute/etc. Any assistance provided is greatly appreciated. Joshua Scott ============================================================================== NOTICE - This communication may contain confidential and privileged information that is for the sole use of the intended recipient. Any viewing, copying or distribution of, or reliance on this message by unintended recipients is strictly prohibited. If you have received this message in error, please notify us immediately by replying to the message and deleting it from your computer. ==============================================================================

2 1

Apache Syslog-ng/Syslog-ng newbie
by Esquivel, Vicente 15 Nov '05

15 Nov '05

Hello all, I am new to this list, I am seeking some help on how to setup syslog-ng as a central log server. More importantly I am wanting to know how to log all of my Apache servers to the central log server, but also create separate logs for each of the systems. For example I am looking to do something like this: Apache1 /var/log/Apache1/httpd/access.log /var/log/Apache1/httpd/error.log Apache2 /var/log/Apache2/httpd/access.log /var/log/Apache2/httpd/error.log Apache3 /var/log/Apache3/httpd/access.log /var/log/Apache3/httd/error.log and so on. Thanks all in advance Vince

1 0

Problem with source File and destination File
by Daniel Fritz 14 Nov '05

14 Nov '05

Hello, I wrote for testing a small shell script witch put every second a line with the same information into a file called "imperator.log". I would like to take the file thrue syslog-ng and write it into a destination file but it did not work ... has somebody a hint ? This is my configfile : options { sync (256); time_reopen (10); log_fifo_size (4096); long_hostnames (off); use_dns (no); use_fqdn (no); create_dirs (no); keep_hostname (yes); }; source s_test { file ("/tmp/imperator.log"); internal(); }; destination d_test { file("/var/tmp/testreceive.log"); }; destination d_msg { file("/tmp/$HOST-messages-$MONTH-$YEAR" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; #log { source(s_sys); filter(f_filter1); destination(d_cons); }; # log { source(s_sys); filter(f_filter2); destination(d_mesg); }; # log { source(s_sys); filter(f_filter3); destination(d_auth); }; # log { source(s_sys); filter(f_filter4); destination(d_mail); }; # log { source(s_sys); filter(f_filter5); destination(d_mlal); }; # log { source(s_sys); filter(f_filter6); destination(d_spol); }; # log { source(s_sys); filter(f_filter7); destination(d_boot); }; # log { source(s_sys); filter(f_filter8); destination(d_cron); }; log { source(s_test); destination(d_msg); }; Thx Daniel ______________________________________________________________ Verschicken Sie romantische, coole und witzige Bilder per SMS! Jetzt bei WEB.DE FreeMail: http://f.web.de/?mc=021193

3 2

syslog-ng incorrectly parsing some messages
by Crayola 08 Nov '05

08 Nov '05

I am running syslog-ng 1.8.6 on my central syslog server. The syslog clients run standard syslog daemons that come with the operating systems. Solaris, Cisco, etc. I have noticed in my syslog-ng database (mysql) that there are many entries like these. (two separate rows) | 192.168.11.27 | kern | info | info | 06 | 2005-11-05 | 22:37:20 | scsi | scsi: [ID 365881 kern.info] /sbus@2,0/QLGC,isp@1,10000 (isp0): | 512925 | ------------------------------------------------------------------------- | Firmware | kern | info | info | 06 | 2005-11-05 | 22:37:20 | Version | Version: v1.37.5, Customer: 15, Product: 0 | 512926 | These seem to be the result of syslog-ng incorrectly (or the remote client) parsing the syslog message. This is the original syslog messages that the Solaris 9 client logs to its logs. Nov 5 22:37:20 lefou scsi: [ID 365881 kern.info] /sbus@a,0/QLGC,isp@1,10000 (isp1): Nov 5 22:37:20 lefou Firmware Version: v1.37.5, Customer: 15, Product: 0 As you can see the original is two separate messages as well but what gets logged to syslog-ng's database doesn't contain the hostname for the second message. In the second entry.. the hostname is listed as "Firmware" I have found many examples of these multiline messages being parsed incorrectly if you need more. Any ideas? Thanks, Mike Another example... Nov 5 22:37:20 lefou scsi: [ID 365881 kern.info] /sbus@3,0/SUNW,fas@3,8800000 (fas0): Nov 5 22:37:20 lefou rev 2.2 FEPS chip | 192.168.11.27 | kern | info | info | 06 | 2005-11-05 | 22:37:20 | scsi | scsi: [ID 365881 kern.info] /sbus@3,0/SUNW,fas@3,8800000 (fas0): | 512932 | | rev | kern | info | info | 06 | 2005-11-05 | 22:37:20 | | 2.2 FEPS chip | 512933 |

2 1

filter based on IP - catching other IPs?
by crayola＠optonline.net 08 Nov '05

08 Nov '05

I am running syslog-ng 1.6.8 as a central log host. everything is working great.. except for my filters. I want to filter all messages from 192.168.10.1 and 192.168.10.2 into other locations. Unfortunatly I seem to be catching other IP addresses in the filter below. Examples: 192.168.10.151, 192.168.10.197, 192.168.10.22 Is there anything I can do to make this filter more specific without resorting to regex. filter fw_only { ( host("192.168.10.1") or host("192.168.10.2") ); }; Thanks, Mike

4 3

syslog-ng log processing
by Metal Gear 07 Nov '05

07 Nov '05

hi guys, would anyone recommend any log analysis and reporting tool for log files obtained through syslog-ng. I tried to use logwatcher but i was unable to properly configure that too. Thanks

1 0

Architecture redundancy
by philip 07 Nov '05

07 Nov '05

Hi, I would like to setup two syslog server so that I don't need to have outage if I need to do some update/upgrade on the system, my questions is how should I set it up? I can send all the traffic to both servers, but I can only load the data to a database on one system at a time. If I need to down the primary system, that mean I need to switch to the secondary to load the data and switch it back when primary is up again. How I can make sure I get all the data load on the database and make sure the syslog data on both servers are the same? Thanks. Hermann

3 2

big log server
by jorge severino 05 Nov '05

05 Nov '05

hi... i'am try install central log server for some squid proxy's and mail postfix's servers. i planning use syslog-ng in central server with FreeBSD 6.0, syslog-ng and Awstat for show web logs. AWstat is compatible with syslog-ng? any comments or suggeren.... thanks...

1 0

TZ DST offset problem in 1.6.8 syslog-ng using $TZOFFSET or $ISODATE....
by Peter Valdemar Mørch 04 Nov '05

04 Nov '05

Hi, I've seen the "ISODATE offset?" thread, and I seem to be seeing the exact same thing: https://lists.balabit.hu/pipermail/syslog-ng/2004-November/006633.html The problem appears only during Daylight Savings Time ("summer time"), not during standard/non-DST/"Winter" time. We just entered non-DST time this weekend (and hence the bug "stopped"). During DST the TZ offset does not include the offset due to DST. So TZ is off-by-one during DST. About this section #if HAVE_GLOBAL_TIMEZONE length = snprintf(dest, left - 1, "%c%02ld%02ld", timezone > 0 ? '-' : '+', (timezone < 0 ? -timezone : timezone) / 3600, (timezone % 3600) / 60); #else Bazsi writes in the thread: > Thanks. Either the value in timezone is not set properly, or it does not > contain the daylight-saving offset, or my code has an error. > > I'll check (I've checked DST before, and timezone should reflect it, so > it _might_ be a problem in libc) I'll see what I can do. Has there been any progress on this? After typing up this report I notice the 1.9.6 NEWS and see: "Fixes in local timezone detection, it should properly detect DSTs on Linux, Solaris and probably BSDs". Is this the same bug? Any chance of this fix being back-ported into a 1.6 maintenance release to show up automagically in debian? (There are no TZ environment variables set on this machine. Also what should it be set to? Following GNUs docs doesn't help. See below.) ************ environment ************* > cat /etc/timezone Europe/Copenhagen > ls -l /etc/localtime lrwxrwxrwx 1 root root 37 2005-10-25 07:13 /etc/localtime -> /usr/share/zoneinfo/Europe/Copenhagen syslog-ng 1.6.8-1 > set | grep -i TZ (no output - se below under "Tried setting TZ env") # I'm using 1.6.8-1 on debian (==newest in testing+unstable), # and the poster in the thread from Nov 2004 was using 1.6.4-1. > dpkg-query -W 'syslog-ng' > dpkg-query -W libc6 libc6 2.3.5-6 ************ syslog-ng.conf snippet ************* destination d_template { file("/tmp/syslog-template.log" template("\"DATE'$ISODATE'TZOFFSET'$TZOFFSET'FULLDATE'$FULLDATE'MSG'$MSG\n") template_escape(yes)); }; log { source(s_all); destination(d_template); }; ************ non-DST example - works ************ # date, perl and syslog-ng all agree with the truth that # we're +0100 during "wintertime" - non-DST. > date --rfc-2822 Mon, 31 Oct 2005 00:00:06 +0100 > perl -le 'use POSIX; print strftime ("%a, %d %b %Y %H:%M:%S %z", localtime);' Mon, 31 Oct 2005 00:00:08 +0100 > logger 'A message' > sudo tail /tmp/syslog-template.log | grep 'A message' "DATE'2005-10-31T00:00:11+0100'TZOFFSET'+0100'FULLDATE'2005 Oct 31 00:00:11'MSG'pvm: A message ************ DST example - fails ************ # Date and perl agree with the truth that # we're +0200 during "summertime" - dst. > date --rfc-2822 Tue, 25 Oct 2005 00:14:13 +0200 > perl -le 'use POSIX; print strftime ("%a, %d %b %Y %H:%M:%S %z", localtime);' Tue, 25 Oct 2005 00:14:15 +0200 # syslog-ng seems to think we're +0100 > logger 'A message' > sudo tail /tmp/syslog-template.log | grep 'A message' "DATE'2005-10-25T00:14:17+0100'TZOFFSET'+0100'FULLDATE'2005 Oct 25 00:14:17'MSG'pvm: A message *********** Tried setting TZ env **************** I tried setting the TZ environment variable as pr. http://www.gnu.org/software/libc/manual/html_node/TZ-Variable.html And notice that perl (or rather the POSIX implementation of strftime()) adheres to it: > TZ=:/usr/share/zoneinfo/Asia/Tokyo perl -le 'use POSIX; print strftime ("%a, %d %b %Y %H:%M:%S %z", localtime);' Tue, 25 Oct 2005 07:03:32 +0900 > TZ=:/usr/share/zoneinfo/Europe/Copenhagen perl -le 'use POSIX; print strftime ("%a, %d %b %Y %H:%M:%S %z", localtime);' Tue, 25 Oct 2005 00:03:39 +0200 Using Asia/Tokyo or Europe/Copenhagen does affect syslog-ng, but it still has a offset-by-one error during DST! # Not my real timezone # export TZ=:/usr/share/zoneinfo/Asia/Tokyo # /etc/init.d/syslog-ng restart # logger 'A message' # tail /tmp/syslog-template.log | grep 'A message' "DATE'2005-10-25T07:06:14+0900'TZOFFSET'+0900'FULLDATE'2005 Oct 25 07:06:14'MSG'pvm: A message # My real timezone - should be +0200 on oct 25 in # Copenhagen as strftime also knows. # # export TZ=:/usr/share/zoneinfo/Europe/Copenhagen # /etc/init.d/syslog-ng restart # logger 'A message' # tail /tmp/syslog-template.log | grep 'A message' "DATE'2005-10-25T00:06:57+0100'TZOFFSET'+0100'FULLDATE'2005 Oct 25 00:06:57'MSG'pvm: A message -- Peter Valdemar Mørch http://www.morch.com

3 2

syslog-ng-1.9.6 template bug patch
by Peter Nahas 03 Nov '05

03 Nov '05

I have stumbled upon a bug in syslog-ng-1.9.6 caused by an un-cleared buffer in logwriter.c which causes templated messages to be output improperly. Up until a certain point (not certain why it stops, perhaps due to a buffer size?), for each message output, all previous messages are output. For example, if the messages "One" "Two" and "Three" are sent to syslog-ng, the destination will receive "One" "One" "Two" "One" "Two" "Three". I have included a patch which solves the issue, but there may be a better solution. If you want a syslog-ng.conf which will produce this issue, let me know. Thanks, Peter Nahas Software Engineer MRV Communications - InReach Division --- 1.9.6/logwriter.c 2005-10-26 09:59:09.000000000 -0400 +++ mine/logwriter.c 2005-10-26 09:59:58.000000000 -0400 @@ -160,7 +160,8 @@ { LogTemplate *template = NULL; - + g_string_assign(result, ""); + if (self->options->template) { template = self->options->template;

2 1

hostname
by Atif Munir 03 Nov '05

03 Nov '05

mysql logs shows that information is stored in the db on the basis of IP.....:-( which sucks. mysql> select * from logs; | 172.16.2.4 <http://172.16.2.4> | auth | crit | crit | 22 | 2005-11-02 | 22:30:27 | su | su: [ID 810491 auth.crit] 'su root' failed for atifmun on /dev/pts/1 | 13115 | +-------------+----------+----------+---------+------+------------+----------+-------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-------+ 13115 rows in set (0.11 sec) Please help....thanks in advance. atif

2 1

syslog-ng changing permission on /dev/klog
by hammy 02 Nov '05

02 Nov '05

I hope someone can help me out with this problem b.c. I'm butting my head against the wall... I have installed and configured syslog-ng to my (preliminary) satisfaction and have been able to run it from a terminal without any problems. Syslog-ng creates logs and is generally happy. But when I run it, I get one line that says syslog-ng is changing the permissions on /dev/klog. I am running syslog-ng on a Mac OS 10.3.9. When I edit /etc/rc to remove the startup for syslog and enter the folowing: /path/to/syslog-ng -f /path/to/syslog-ng.conf -p /path/to/syslog.pid and reboot the machine spins and does not finish booting. If I boot the machine verbosely I can see that it is hanging while trying to change the permissions for /dev/klog. Any suggestions on what is going wrong?

2 1

hostname
by Atif Munir 02 Nov '05

02 Nov '05

Thanks for the reply....I have the /etc/hosts like this 172.16.2.4 server1 172.16.2.7 server2 but still I am unable to get the hostnames on the web......All clients are there with their IP address. Thanks a lot for those who replied my question. Atif

1 0

hostname
by Atif Munir 01 Nov '05

01 Nov '05

I am getting the messages on my syslog-ng server but the hostname is not there .......The messages are there on the IP address based .....Is there a way to replace IP with the hostname.......... Thanks in advance. Atif

3 2

host_cache.txt and date_cache.txt
by javier rojas 01 Nov '05

01 Nov '05

hello, i have a simple question, i'm trying to make a manual for the instalation of php syslog-ng (for documentation) but i don't know what exactly are host_cache.txt and date_cache.txt for... can anyone explain me what are they for? -- Ciao,Javier linux user #393724

1 0

program() destination in 1.9.6: respawning not automatic?
by Paul Krizak 28 Oct '05

28 Oct '05

I built the latest stable copy of 1.9 (1.9.6) a few days ago and I'm seeing some behavior that doesn't seem to jive with the documentation. The docs say that the program() destination in 2.0 (which is presumably what 1.9.X is preparing for) should respawn the program if it dies. However, this doesn't seem to be the case; you must signal syslog-ng with a HUP before it'll respawn the program. Is this expected behavior? And if it is, is there some way to make syslog-ng respawn the program immediately instead of waiting for a HUP signal? Thanks! -- Paul Krizak 5900 E. Ben White Blvd. MS 625 Advanced Micro Devices Austin, Tx 78741 Linux/Unix Systems Engineering Phone: (512) 602-8775 Microprocessor Solutions Sector

2 1

syslog-ng.conf : option group(<gid>); does not work ( stable version )
by Yan M. 28 Oct '05

28 Oct '05

Hi, in syslog-ng.conf man page it is said that the option group(gid); is used to set group on created logfiles. Im trying to use that and it does not work it is setting the group, not to the group I specify in that group() directive, but to the group syslog-ng runs as. Also, the man page specifies you have to enter the gid in the group() option but the syslog-ng daemon wont start when the gid is specified in its numeral form. It should be group(groupname); instead of group(gid); in the man page. Does the chgrp works only when syslog-ng is running as root ? If so, it is not a documented feature .. --------------------------------- Yahoo! FareChase - Search multiple travel sites in one click.

3 4

filter help
by Greg Rodenhiser 27 Oct '05

27 Oct '05

I have several remote servers that are logging via regular syslog to my central syslog-ng server. This is working fine. Now, I have several distinct messages from different servers that I want to filter to a single log file (without having anything else in this file). I have tried setting it up but I'm having problems... 1.) I have made six filter lines in syslog-ng.conf that contain the host/message combination I want to put in my special log. I have named these six filters the same name (f_interest). I then have a log line that contains the name of the filer (the filter name is used for six filter declarations), and the destination for the file I want to log to. My problem/question is, How does syslog-ng handle multiple filters that have the same name? Each of these 6 filters contain a host and word match I want to have interpreted. My problem is nothing is getting logged to my log. Does syslog-ng somehow combine these 6 filters because they have the same name? I want each one to be interpreted separately from the others with the same name. I only named them the same to prevent having to make 6 different log directives to the same file. 2.) How do I do a multiple not match. For instance I want to log messages from serverA that do NOT contain the text, message1, or message2, or message3, but log everything else from serverA. Right now I do... filter f_interest { not match("(message1|message2|message3)") and host(serverA); }; Does that look right? Thanks in advance!!

1 0

high performance server
by JR Mayberry 27 Oct '05

27 Oct '05

I've googled this topic and read the mailing list and haven't had much luck improving my situation. I have a very high volume syslog-ng server. I currently have logs that are being received across the network but not being written to disk. This could be as much as 25% of the logs being dropped. The STAT to syslog always says 0 drops. It's a Netro 1405 w/ two CPUs and 1 gig of memory connected to a SAN. syslog-ng is always at 49% CPU and never goes beyond that. What settings can I use to stop dropping logs? This is an output of iostate with an interval of 1. This will give you an idea of performance. As you can see there are no disk waits. Thanks. device r/s w/s Mr/s Mw/s wait actv svc_t %w %b md89 2.0 86.0 0.0 0.4 0.0 0.2 1.9 0 5 md89 0.0 3.0 0.0 0.0 0.0 0.0 0.9 0 0 md89 0.0 1.0 0.0 0.0 0.0 0.0 2.5 0 0 md89 0.0 1.0 0.0 0.0 0.0 0.0 1.2 0 0 md89 0.0 2.0 0.0 0.0 0.0 0.0 1.2 0 0 md89 0.0 61.0 0.0 0.3 0.0 0.1 1.3 0 3 md89 0.0 1.0 0.0 0.0 0.0 0.0 1.5 0 0 md89 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0 0 md89 0.0 2.0 0.0 0.0 0.0 0.0 0.9 0 0 md89 0.0 2.0 0.0 0.0 0.0 0.0 0.7 0 0 md89 0.0 83.0 0.0 0.4 0.0 0.2 2.2 0 3 md89 2.0 4.0 0.0 0.0 0.0 0.0 3.0 0 2 md89 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0 0 md89 0.0 1.0 0.0 0.0 0.0 0.0 0.8 0 0 md89 0.0 1.0 0.0 0.0 0.0 0.0 0.8 0 0 md89 1.0 86.0 0.0 0.4 0.0 0.1 1.2 0 4 md89 0.0 2.0 0.0 0.0 0.0 0.0 0.9 0 0 md89 0.0 5.0 0.0 0.0 0.0 0.0 0.9 0 0 md89 0.0 1.0 0.0 0.0 0.0 0.0 1.0 0 0 md89 0.0 2.0 0.0 0.0 0.0 0.0 0.8 0 0 md89 2.0 751.9 0.0 5.6 0.0 6.5 8.6 0 25

3 5

1.6.5 performance
by Scott C 24 Oct '05

24 Oct '05

I am currently experiencing an odd performance issue with syslog-ng 1.6.5. I use several load-balanced relays which receive syslog traffic via both udp and tcp. They forward all traffic to the back-end collection hosts exclusively via tcp. Overall, this environment collects around 60GB of log data per day. All of the relays have identical Solaris 8 builds, as well as identical syslog-ng configurations. Here is the pertinent snippet from a configuration file: options { stats(300); sync(0); time_reopen(10); log_fifo_size(3000000); gc_busy_threshold(200000); check_hostname(no); keep_hostname(yes); }; As you can see, my fifo queue is enormous. Despite that fact, syslog-ng on any given relay will begin dropping messages at an alarming rate (600-700 per second) when combined inbound and outbound tcp traffic increases beyond a certain threshold. Said threshold seems to be a bit low to me, though. We're talking somewhere in the neighborhood of 700 tcp segments per second. The corresponding inbound UDP dgrams are usually between 200 and 400 per second. It should be noted that the IP stack is handling the load just fine. Also, CPU utilization rarely exceeds 60 or 70 percent. The collection hosts are fairly beefy systems that are barely breathing even during peak load. I've watched both the IP stack and syslog-ng on these systems, and they're keeping up just fine. I know the FIFO queue size probably seems unreasonable here, but the lower I make it, the worse the drops. Of course, the higher I make it, the more memory it eats up. And in some cases, I've seen syslog-ng eventually eat it all up and the scanner kicks in. But what's really most peculiar in this scenario is the fact that the numbers simply don't add up. Why does syslog-ng appear (on the surface) to be dropping a very large percentage of the messages that it receives? I realize that it's not, but the numbers tell a different story. And how could it possibly drop so many messages when the FIFO queue is configured to buffer three million lines? How preposterous! Am I way off base here? --------------------------------- Yahoo! FareChase - Search multiple travel sites in one click.

4 13