Bill Graham on Fri, Apr 11, 2003 at 02:19:48PM -0700: Hi Bill,
I guess I should have included the rest of my configuration...
you're right, this sounds like one happy syslog server :)
It just seems that the program can't keep up when the udp buffer is set to the default of 8K. Once you bring this number to the system max of 64K the system can handle bursts of around 750 syslog messages.
Do you see message loss with higher rates again? Increasing sockbuf certainly does make sense, but it still wouldn't explain why a userland- program can't keep up if your system resources are not exhausted. You could maybe try to avoid interrupts/context switches by using async disk access, and see if that improves performance. Binding syslog-ng to one CPU is probably not reasonable, since you plan to deploy other applications. Then obviously, you will have to expect performance to drop again, if hardware (unlikely, I admit) or kernel resources are the real limitation you're looking at. Regards, -- ____ ____ / _/| - > Gregor Binder <gb@(rootnexus.net|sysfive.com)> | / || _\ \ \__ Id: 0xE2F31C4B Fp: 8B8A 5CE3 B79B FBF1 5518 8871 0EFB AFA3 E2F3 1C4B