Hey gurus
I will try 1.9.9 again when I have more time. I tried it once and it literally killed me with stats although I had stats(0) set.
It was insane so I turned it off again. As I said when I have more time
but I was wondering whether some of the log delivery probs may have to
do with oracle rac. It seems those machines are particulary bad and a
netstat -ee reveals the great amount of open tcp connections used by 'oracle' for the cluster stuff.
I have an average of 300 lines like this in netstat -ee:
tcp
0 0
{host-vip}:1521
{host-real}:44853
ESTABLISHED oracle 1176037944
the real and VIP are on the same box. my log is stuffed of the dreaded :
Mar 9 18:51:26 {host} syslog-ng[29085]: Connection broken to AF_INET(localhost:5000), reopening in 10 seconds
I'm thinking this box run out of sockets but I'm not too sure how to properly ts/prove that. netstat -s seems to show
random drops but on all machines.
Would anyone have more hints on how to check whether I have to tune the
kernel for these boxes ? Sorry but this is the first time I'm digging
that deep into the stack...
PS: any chance 2.0 will include temporary message supressant code -
syslog style (the only thing I really liked about old syslog) ?
On 3/3/06, Balazs Scheidler <bazsi@balabit.hu> wrote:
On Thu, 2006-03-02 at 16:15 -0800, stucky wrote:
>
> thanks for your reply ! I am already using keepalive on the server :
>
> tcp (ip("**********")
> port(5000)
> max-connections(1000)
> keep-alive(yes)); };
>
> It doesn't look like I can specify this option on the client though.
> If I try something like :
> destination loghost { tcp("*********" port(5000) keep-alive(yes)); };
>
> It complains about a syntax error. I have never seen an option called
> 'tcp-keep-alive()' but I tried it without
> luck. It always complains about a syntax error. I guess you meant
> 'keep-alive(yes)' right ?
tcp-keep-alive was added in 1.6.3 as I read my changelogs.
keep-alive and tcp-keep-alive are different beasts, the first means that
syslog-ng should keep all connections open through reloads, the second
means to enable SO_KEEPALIVE option.
>
> As far as upgrading is concerned I want to but I wanted to wait till
> 2.0 is out and stable. Any ETA ?
It all depends on testers. Judging the feedback it is either rock solid,
or no-one is using it. I suspect it is the latter.
In the current situation an "it works for me" messages would help a lot,
the first can be this very mail, as I've been using 1.9.x snapshots for
about a year now.
--
Bazsi
_______________________________________________
syslog-ng maillist - syslog-ng@lists.balabit.hu
https://lists.balabit.hu/mailman/listinfo/syslog-ng
Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
--
stucky