mmmmmm! much nicer. For some reason I was thinking of taking the output of my modifications and putting them in Excel or something. throwing them in an RRD will be a lot better. thanks, Mike On Thu, 7 Apr 2005, UNIX Admin wrote:
search for the post by Jay Guerrette (sp?) where he posted some C code to maintain stats - and I think also input them into an RRD database so you can view graphs. No source mods needed, just a program destination to keep track - much cleaner in the long run if it can keep up with your load.
On Apr 7, 2005 11:49 AM, Jim <jim@jeke.fdns.net> wrote:
Anyone have any thoughts on this?
---------- Forwarded message ---------- Date: Fri, 1 Apr 2005 13:45:48 -0500 (EST) From: Jim <jim@jeke.fdns.net> Reply-To: syslog-ng@lists.balabit.hu To: syslog-ng@lists.balabit.hu Subject: [syslog-ng]incoming message stats
Hello,
I would like to get some stats on the number of incoming messages I am receiving on a central log server.
I am running syslog-ng 1.6.6, built with libol 0.3.15.
From what I can see, I will need to modify libol in order for syslog-ng to count these messages, and tell me at a regular interval. Does this sound right, or am I missing another simple way to do this?
assuming I have to modify source, it looks like I can just add a counter to the do_write_str() function in pkt_buffer.c that looks something like this: if (self->queue_size == self->queue_max) { /* fifo full */ pktbuf_dropped_pkts++; ol_string_free(string); return ST_FAIL | ST_OK; } else { struct buffer_node *item; --> pktbuf_recved_pkts++;
NEW_SPACE(item); item->packet = string; ol_queue_add_tail(&self->queue, &item->header); if (++self->queue_size == self->queue_max && self->super.writable) (*self->super.writable) = 0; }
the "-->" indicates the new line.
Pretty much all I did was copy where the "pktbuf_dropped_pkts" was, and added in my variable.
The numbers that I get when I run with this don't appear to totally match up with what I expect, but is fairly close. Is this the right place to insert a counter to count total syslog messages recieved over the network (from both TCP and UDP sources). If not, can someone point me in a different direction?
thanks! Mike _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html