Shot in the dark: have you checked to be sure there aren't checksum errors in the packets? Some kernels will drop bad checksummed packets. On Fri, Apr 15, 2011 at 8:27 PM, Fred Connolly <fred.connolly@gmail.com> wrote:
I am experiencing the same problem with Sun V490 except the server has about 16gb memory. We are using UDP and losing about 85% of the traffic. The udpinoverflows is darn near equal to the total number of packets coming in. I am not at work now so cannot provide accurate statistics at this time. The NIC statistics are perfect, we aren't getting any errors with regards to the UDP area etc.
There is a kernel patch that came out about a week or two ago that deals in this area, but I have not yet applied it. I want to apply the patch first before adjusting other kernel parameters. We have Solaris 10, update 9. Version of syslog-ng is 3.1.2. It is really terrible.
By terrible, I mean the packet loss, not the product:)) It is probably something I don't have set up correctly.
Mike, check out that latest patch, it can't hurt. I had to open a case with Sun to find out about it:))
On Fri, Apr 15, 2011 at 3:45 PM, Matthew Hall <mhall@mhcomputing.net> wrote:
On Fri, Apr 15, 2011 at 02:01:50PM -0400, Mishou Michael wrote:
I left out the resources I have to work with on this system, and how bad/good things are with syslog-ng running (and dropping), I'll include those now. As you can see, it's an older server, but it has a ton of RAM and the CPUs should have enough pop for this I think.
I'm just not sure what to do next to troubleshoot. I'm hoping someone here can point me in the right direction, or at least confirm that they are running syslog-ng in a similar configuration without drops so I know that it's at least possible?
Regards,
--Mike
I think the next suspect would be the disks. Can you disable anything that writes to disk or tell it to write to /dev/null and see if it still blows up?
Also, it's Solaris, so you could start using some of the dtrace scripts to look for what syscalls / other ops are running too slow, and when it gets stuck what type of socket / disk file / what IO is it doing?
Matthew.
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html