On Thu, 2006-05-04 at 09:27 +0200, Martin Meiler wrote:
Hello everybody,
we face a problem with our log-server at our department since the last few weeks. Previously there was no problem concerning this log-server but now we get messages like
syslog-ng[...] STATS: dropped 38142
or sometimes even more.
How can we avoid these dropped messages? Or how can we influence the number of dropped messages? Or why are messages dropped?
Since the syslog protocol is based on UDP we can not really avoid that some packets are dropped if many of them arrive at nearly the same time, or is there a solution.
STATS counts the number of messages that are dropped _inside_ syslog-ng, not counting UDP packet drops. In fact UDP packet drops are not even shown in that counter. You probably have a pipe, tcp or unix-stream destination which cannot cope with the incoming traffic. -- Bazsi