On Thu, 2004-10-28 at 14:50, Stefan Schluppeck wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Hello,
I have running a central syslog-ng under SLES9 (SuSE Linux Enterprice Server).
ca. 90 Servers and 150 Network copunents are logging to this server
I have some times "STATS: dropped 74625" and i have high load round about 11.
What can i do, that no loglines are lost and the load is not so high?
My global config: options { ~ long_hostnames(off); ~ sync(1024); ~ log_fifo_size(300000); ~ gc_busy_threshold(1000); ~ gc_idle_threshold(30000); ~ };
Are you sure it is syslog-ng which generates the load? (because by definition syslog-ng on its own can generate at most a load of 1) The STATS counter is incremented every time syslog-ng would have something to write but the receiving side does not accept messages. Probably you have a program/pipe/tcp destination not accepting messages in a timely manner. Other tuning possibilities (though it affects receiving, not sending) is to to disable DNS resolution and/or increase the UDP receive buffers. -- Bazsi