On Fri, 2009-12-18 at 13:30 -0500, Doug Warner wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 12/18/2009 11:41 AM, Balazs Scheidler wrote:
I guess the big concern here is why our recv-q is so high and what we can do to reduce it.
These are the current global options (nothing set on the src or dest since this syslog server only handles the tcp connections):
options { chain_hostnames(off); dns_cache(yes); log_fifo_size(5000); flush_lines(200); flush_timeout(1000); use_fqdn(yes); stats_freq(300); };
Most destinations are files but we do have one program. The box doesn't seem to be particularly loaded otherwise.
Do these values seem like we're trying to make syslog-ng cache too much information? Is there other settings we should tweak to try to get the messages through syslog-ng faster? Do you have flow control enabled on any of your log paths? is syslog-ng burning your CPU, is it CPU bound?
Periodically when syslog-ng seems to be working fine we'll see syslog-ng using a bit of CPU (~20%), but more commonly right now we see it using very little and the recv-q building up.
Non of our src/dest in syslog-ng have any flags set other than the above global options; so whatever is the default for 3.0.4 OSE should be what we're using.
Strange. Can you start strace on the syslog-ng process, preferably with timestamps (-ttT -s 256 -p <pid>) options to see what it is doing? -- Bazsi