Hello,
the configure file as follows:
options { use_dns(no); create_dirs(yes);ts_format(iso); };
#options { log_fifo_size(3000); };
source src { udp(ip(0.0.0.0) port(514) ); };
filter f_kern { facility(kern); };
filter f_authpriv { facility(auth,authpriv); };
filter f_mail { facility(mail); };
filter f_cron { facility(cron); };
filter f_boot { facility(local7); };
filter f_spooler { facility(uucp, news) and level(crit..emerg); };
filter f_messages { level(info..emerg) and not facility(authpriv, cron, mail); };
destination kern { file("/home/syslog-ng/$YEAR/$HOST/kernel-$MONTH"); };
destination authpriv { file("/home/syslog-ng/$YEAR/$HOST/secure-$MONTH"); };
destination mail { file("/home/syslog-ng/$YEAR/$HOST/maillog-$MONTH"); };
destination cron { file("/home/syslog-ng/$YEAR/$HOST/cron-$MONTH"); };
destination boot { file("/home/syslog-ng/$YEAR/$HOST/boot.log-$MONTH"); };
destination spooler { file("/home/syslog-ng/$YEAR/$HOST/spooler-$MONTH"); };
destination messages { file("/home/syslog-ng/$YEAR/$HOST/messages-$MONTH"); };
log { source(src); filter(f_kern); destination(kern); };
log { source(src); filter(f_authpriv); destination(authpriv); };
log { source(src); filter(f_mail); destination(mail); };
log { source(src); filter(f_cron); destination(cron); };
log { source(src); filter(f_boot); destination(boot); };
log { source(src); filter(f_spooler); destination(spooler); };
log { source(src); filter(f_messages); destination(messages); };
syslog-ng receive logs from about 1000 clients ,and the usage of mem by syslog-ng keeps growing,here are a days record of the usage of mem(got by command 'ps aux'):
cup %mem
0.1 29.9
0.1 30.1
0.1 30.3
0.1 30.5
0.1 30.7
0.1 30.9
0.1 31.1
0.1 31.2
0.1 31.4
0.1 31.6
0.1 31.9
0.1 32.1
0.1 32.3
0.1 32.4
0.1 32.6
0.1 32.8
0.1 33.0
0.1 33.2
0.1 33.4
0.1 33.5
0.1 33.8
0.1 33.9
0.1 34.1
0.1 34.3
0.1 34.5
0.1 34.6
0.1 34.9
0.1 35.0
0.1 35.2
There was a similar thread a few days ago. Could you check whether the the memory usage actually grows when every destinations hit their configured log_fifo_size() values which default to 1000? It would be much better if you could show the actual memory footprint of syslog-ng, see the RSS column of ps's output. Regards, Sandor -------------------------------------------------------- NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.