We recently upgraded to Solaris 10 from Solaris 9 and I don't recall us dropping that many packets before. And we also upgraded from a very older Sylog-ng version to 3.1.2. I am basing the dropped packets on the udp stats, not syslog-ng stats. Syslog-ng stats has NO dropped packets.
In another thread someone was complaining similar issues on Solaris. It seems that the way syslog-ng writes log files (each line an individual write system call), seems to have an enormous overhead on Solaris, much more than on Linux.
Attached is a program that tries to measure the speed difference between write() and writev(). It first writes N messages using write(), one by one, then it writes the same N messages using writev(), IOV_MAX message at a time. On both Linux and Solaris (OpenIndiana, actually, but shouldn't be much different on real Solaris), I get similar results: about 4 seconds for the write()s to finish, and below 1 second for writev(). While the write()->writev() performance is noticable, the difference between Solaris and Linux seems to be so very tiny, that it is pretty much negligible. (Unless, of course, I screwed up the test program, which is entirely possible) -- |8]