We are using 1.6.5 (soon to upgrade to 1.6.11) in a production environment. Is 1.9.11 production ready? I recall a message from you saying that you are looking to release 2.0.0 within a month. I will install 1.9.11 on my QA server and start testing it once we deploy 1.6.11 to prod. I am actually not using /dev/xconsole... I have 2 production loghosts and one of them is more heavily used then the other. I am seeing dropped packets on that one during peak hours. That leads me to believe that syslog-ng. Is there a way to increase the incoming buffer in another way? -----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Balazs Scheidler Sent: May 25, 2006 3:51 AM To: Syslog-ng users' and developers' mailing list Subject: Re: [syslog-ng] Syslog-ng dropped packets. On Wed, 2006-05-24 at 16:35 -0700, Vaibhav Goel wrote:
Recently, I started seeing dropped packets in syslog-ng. I increased the log_fifo_size to 2000 (it was 1000) and it abated the problem somewhat. But I am still seeing some dropped packets. Could I increase the log_fifo_size? Are there any other tips? Unfortunately, we are going to be adding more logging load to this loghost and I am worried that this problem might increase. Any ideas?
The most important part in addressing this problem is finding out which destination drops packets. syslog-ng 1.6.x only gave a global counter. You might have a slow destination (like /dev/xconsole) whereas your normal log flow works fine. If your primary log output is slow, you could switch to 1.9.11 which includes log message flow control. -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html