Hi Bazsi We are still having issues with dropped packets under heavy load. We increased the size of rmem_default and rmem_max drastically but we are not seeing much of an improvement....Maybe about 50% or so. Currently, the sizes are $ > cat /proc/sys/net/core/rmem_default 786426 $ > cat /proc/sys/net/core/rmem_max 1572852 Do you have any other suggestions? We are running syslog-ng 1.6.11. All the logging is done over TCP (except 1 UDP source but that doesn't generate a lot of logging data). Thanks, -----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: May 26, 2006 2:05 AM To: Syslog-ng users' and developers' mailing list Subject: RE: [syslog-ng] Syslog-ng dropped packets. On Thu, 2006-05-25 at 06:27 -0700, Vaibhav Goel wrote:
We are using 1.6.5 (soon to upgrade to 1.6.11) in a production environment. Is 1.9.11 production ready? I recall a message from you saying that you are looking to release 2.0.0 within a month. I will install 1.9.11 on my QA server and start testing it once we deploy 1.6.11 to prod. I am actually not using /dev/xconsole... I have 2 production loghosts and one of them is more heavily used then the other. I am seeing dropped packets on that one during peak hours. That leads me to believe that syslog-ng. Is there a way to increase the incoming buffer in another way?
Are you using UDP or TCP transport? You could increase the socket receive buffer size. /proc/sys/net/core/rmem_default and /proc/sys/net/core/rmem_max -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html