That means that the output queue toward the server became full which indicates that the bottleneck was at the server. You can increase log_fifo_size if this only happens during peaks but that doesn't help if this is permanent. Flow control can also help but that propagates the stall towards applications, eg those will also stall.
------------------------------
Message: 3
Date: Fri, 26 Apr 2013 11:29:39 +0200
From: Balazs Scheidler <bazsi77@gmail.com>
Subject: Re: [syslog-ng] Configuration for a centralized syslog-ng
server
To: "Syslog-ng users' and developers' mailing list"
<syslog-ng@lists.balabit.hu>, eh@gmail.com
Message-ID:
<CAKcfE+bvXksZFdz77SkN8VCrmH15wwbTvUk8xJeWFLEwHpay7w@mail.gmail.com>
Content-Type: text/plain; charset="iso-8859-1"
How do you know messages are dropped?Using freq_stats :)Anyway, I found the issue that wasn't related to syslog-ng.I had the syslog zfs partition on 92% so, after removing a lot of old files, everything went fine.--
d.
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq