well if you are inserting into a database the database is your
bottleneck
it looks like some of messages are being dropped by syslog-ng itself
and some in the udp transit.
the majority being dropped by syslog-ng itself. you can increase the
log_fifo_size to reduce the drops but it wont increase the database
insert rate it will just give you a bigger buffer to handle traffic
spikes. your best bet is to tune the database to get a faster insert
rate. also disabling the atime on the file system should help.
On 3/31/2010 11:47 PM, Clayton Dukes wrote:
Hi Folks,
I'm trying to run a test to check insert rates.
If I run this command:
./loggen -r 5000 -D -I 10 127.0.0.1 514
The output shows:
average rate = 5441.60 msg/sec, count=54420, time=10.007, msg size=256,
bandwidth=1360.40 kB/sec
But, my stats don't show that many messages received:
syslog-ng[6660]: Log statistics; dropped=\'pipe(/dev/xconsole)=0\',
processed=\'center(queued)=24232\', processed=\'center(received)=8077,
processed=\'destination(df_logzilla)=8077\'
As you can see, it sent 55k messages, but I only received 8k.
Am I doing something wrong?
Here are my options in the syslog-ng config:
options {
long_hostnames(off);
log_msg_size(8192);
flush_lines(1);
log_fifo_size(16384);
time_reopen(10);
use_dns(yes);
dns_cache(yes);
use_fqdn(yes);
keep_hostname(yes);
chain_hostnames(no);
perm(0644);
stats_freq(60);
};
--
______________________________________________________________
Clayton Dukes
______________________________________________________________
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.campin.net/syslog-ng/faq.html