On Mon, Dec 18, 2006 at 07:24:47PM +0100, Balazs Scheidler wrote:
On Mon, 2006-12-18 at 15:23 +0000, Hari Sekhon wrote:
I've got a central logserver on syslog-ng and am getting the following in my logs:
syslog-ng[26180]: Error accepting AF_UNIX connection, opened connections: 100, max: 100
AF_UNIX refers to unix domain sockets, e.g. you are probably hitting the maximum on unix-stream("/dev/log");
Yup, either change it to: unix-dgram("/dev/log"); ...or: unix-stream("/dev/log" max-connections(200)); I see problems with /dev/log connections piling up when boxes are under high load, like 30+. When syslog-ng doesn't get enough CPU time to deal with incoming logs, you either have to move to unix-dgram and accept the possibility of message loss, or keep increasing the /dev/log connection limit and hope your boxes eventually catch up. :( -- Nate ASCII and ye shall receive.