-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 12/15/2009 03:17 PM, Balazs Scheidler wrote:
Possibly a socket structure (but AFAIR it has its own slab). Can you check if: * syslog-ng has too many open sockets (visible for example with lsof)
We have about 290 open TCP connections.
* whether it reads its input queue (although network packets would again not show up in the slab), using netstat -antp
Most have smallish Recv-Q's (<2000KB), but a couple hosts have receive queues of 50KB, and one of >1MB. Is this an indication that my syslog-ng instance is overloaded and can't get the data out to disk fast enough?
* possibly check the network statistics: netstat -ns
Nothing looks too odd here. Thanks for your help debugging this issue! - -Doug -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iD8DBQFLKPSSJV36su0A0xIRApNsAKDcdXer/qYeXLsiGXj3fHnnb3PrswCgmrV+ Txho9qhyIJxvXVeoirEgSws= =75bV -----END PGP SIGNATURE-----