well if you are inserting into a database the database is your bottleneck it looks like some of messages are being dropped by syslog-ng itself and some in the udp transit. the majority being dropped by syslog-ng itself. you can increase the log_fifo_size to reduce the drops but it wont increase the database insert rate it will just give you a bigger buffer to handle traffic spikes. your best bet is to tune the database to get a faster insert rate. also disabling the atime on the file system should help. On 3/31/2010 11:47 PM, Clayton Dukes wrote:
Hi Folks, I'm trying to run a test to check insert rates. If I run this command:
./loggen -r 5000 -D -I 10 127.0.0.1 514
The output shows: average rate = 5441.60 msg/sec, count=54420, time=10.007, msg size=256, bandwidth=1360.40 kB/sec
But, my stats don't show that many messages received:
syslog-ng[6660]: Log statistics; dropped=\'pipe(/dev/xconsole)=0\', processed=\'center(queued)=24232\', processed=\'center(received)=8077, processed=\'destination(df_logzilla)=8077\'
As you can see, it sent 55k messages, but I only received 8k. Am I doing something wrong?
Here are my options in the syslog-ng config: options { long_hostnames(off); log_msg_size(8192); flush_lines(1); log_fifo_size(16384); time_reopen(10); use_dns(yes); dns_cache(yes); use_fqdn(yes); keep_hostname(yes); chain_hostnames(no); perm(0644); stats_freq(60);
};
-- ______________________________________________________________
Clayton Dukes ______________________________________________________________
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html