The host 'pns1' is a - let's say a syslog repeater. It gets messages from 5 hosts via tcp (two of these five are mailservers and send the maiilog via syslog-ng) and from 2 hosts as well as an internet router/firewall via udp. The syslog-ng writes the lines into files as well as into a pipe where a third program read the lines and evaluates they according to given patterns. Additionally the syslog-ng sends all messages through a ssh tunnel to another syslog-ng. This is the whole situation.Aafter including the "log_fifo_size (128056);" parameter there were no dropped lines anymore. Stephan
ken.garland@rotech.com 11.08.2005 14:52:34 >>> Mike Tremaine wrote:
On Wed, 2005-08-10 at 07:21, Stephan Hendl wrote:
the lines with values "STATS: dropped <!=0>" are very annoying. How can I prevent the syslog-ng from dropping lines??? I put the line "log_fifo_size(1000);" into the global section - hope that helps ;-)))
If the hosts only job is syslog-ng go for broke and kick it up to something higher then 1000.
log_fifo_size (128056);
[I used that when I was doing some testing with an old AMD-k62 500mhz 256MB and FC3, it ran with 5 hosts sending as fast as the could to it. Didn't drop anything.]
I have about 15 systems logging to my syslog-ng server and some of them are routers which send a ton of messages about up/down link state. This server is getting smashed with logs and I have not received any dropped messages other than the 'DROPPED 0' which is a good thing that the syslog-ng host is saying it has not dropped any log packets. I would think something else is going on here and the fifo would not need to be increased as my fifo setting is only at 1024. In your first message you pasted something from the host 'pns1' which was complaining about dropping multiple packets. What is this system and is it running syslog-ng, also what connection is it using? tcp/udp? Are there other hosts which are sending out dropped log messages or only pns1? - Ken _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html