On Mon, 24 Jan 2011 18:29:19 +0200, Balazs Scheidler <bazsi@balabit.hu> wrote:
On Mon, 2011-01-24 at 11:50 +0200, Aleksei Plotnikov wrote:
Hello everyone,
I have a problem with getting statistics from syslog-ng 3.0.5 (under Debian 5.0.4) using it's socket file.
In our configuration logs received by syslog-ng are being forwarded to python scripts (which in turn send logs to database). Since sometimes these scripts cannot handle the load, we want to monitor syslog-ng statistics for dropped logs. Currently, I run a script from cron which get statistics from syslog-ng socket file like this "echo STATS | socat - /var/lib/syslog-ng/syslog-ng.ctl" and then parse output. Most of time it works great, but during peak times when number of logs get higher ( ~2000 logs/sec instead of ~1500 logs/sec), this cron script cannot get any output from statistics. Also this message appears in /var/log/syslog: syslog-ng[21677]: Error writing control channel; error='Broken pipe (32)'
Is it possible to tune syslog-ng statistics somehow, or maybe there is a better way to get statistics?
Hmm. broken pipe seems to indicate that your script exited before syslog-ng could actually write all the statistics output to it.
e.g. please check if your script actually reads the complete output before exiting.
That's right, problem was caused by socat, which was closing the pipe before syslog-ng could generate/send statistics output. Socat (netcat analog) has default timeout for inactivity 0,5 seconds and it seems that syslog-ng was not able to respond that fast when under higher load. After increasing socat timeout problem disappeared. Thanks for help! Aleksei