I see,perhaps the messages A received are different from B. -----邮件原件----- 发件人: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] 代表 Balazs Scheidler 发送时间: 2007年9月20日 14:38 收件人: Syslog-ng users' and developers' mailing list 主题: Re: [syslog-ng] puzzled about the system resources used by syslog-ng On Thu, 2007-09-20 at 12:27 +0800, liuruihong wrote:
Eenvironment :
under linux
1 central log-collecting server.syslog-ng
2 client: syslog sending logs to central log-collecting server.
And I have two central log-collecting servers which is logging for different clients,I call them A and B.
configuration
1 The A ` configuration as follows:
options { use_dns(no); create_dirs(yes);ts_format(iso); };
source src { udp(ip(0.0.0.0) port(514)); };
filter f_kern { facility(kern); };
filter f_authpriv { facility(auth,authpriv); };
filter f_mail { facility(mail); };
filter f_cron { facility(cron); };
filter f_boot { facility(local7); };
filter f_spooler { facility(uucp, news) and level(crit..emerg); };
filter f_messages { level(info..emerg) and not facility(authpriv, cron, mail); };
destination kern { file("/home/syslog-ng/$YEAR/$HOST/kernel-$MONTH"); };
destination authpriv { file("/home/syslog-ng/$YEAR/$HOST/secure-$MONTH"); };
destination mail { file("/home/syslog-ng/$YEAR/$HOST/maillog-$MONTH"); };
destination cron { file("/home/syslog-ng/$YEAR/$HOST/cron-$MONTH"); };
destination boot { file("/home/syslog-ng/$YEAR/$HOST/boot.log-$MONTH"); };
destination spooler { file("/home/syslog-ng/$YEAR/$HOST/spooler-$MONTH"); };
destination messages { file("/home/syslog-ng/$YEAR/$HOST/messages-$MONTH"); };
log { source(src); filter(f_kern); destination(kern); };
log { source(src); filter(f_authpriv); destination(authpriv); };
log { source(src); filter(f_mail); destination(mail); };
log { source(src); filter(f_cron); destination(cron); };
log { source(src); filter(f_boot); destination(boot); };
log { source(src); filter(f_spooler); destination(spooler); };
log { source(src); filter(f_messages); destination(messages); };
2 The B` configuration as follows:
source src { unix-stream("/dev/log");internal();udp(ip(0.0.0.0) port(514)); };
destination dsearch { file("/home/work/syslog-ng/log/$HOST"); };
log { source(src); destination(dsearch); };
QUESTIONS:
A server log files: ps aux
/home/syslog-ng/2007/ 10.11.100.3 / messages %MEM VSZ RSS
965 directories 3860 6.8 567772 562524
B server log files: ps aux
/home/work/syslog-ng/log/10.12.55.6 % MEM VSZ RSS
4482 0.0 2232 1276
I think the MEM VSZ and RSS usage is related to the logfile numbers, A server has fewer logfiles than B server, while A server has higher usages of MEM VSZ and RSS than B server,
I don`t know why ?
Hmm... it it a genuine leak, I mean does it continously grow, or it stays at this limit and gets decreased during off-peak time? In syslog-ng every destination file has its own buffer, though that's allocated on-demand, the maximum size can be specified using log_fifo_size(), though the minimum value is 1000 log messages. 1000 messages, 300 bytes on average is about 300kB maximum memory usage per file. How many messages are processed by syslog-ng here? Is each file receiving the same amount of messages? -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html