On Thu, Jun 06, 2002 at 03:16:22PM -0400, Clayton L. Scott wrote:

Here are my system stats:

Linux 2.4.7-10 i686 ext3 filesystem syslog-ng 1.4.11

I'm trying to do some stress testing of our syslog-ng configuration on a server for log collection and if I send 50 msg/s I find that a bunch are not ending up in the destination file.

Where I should I be looking for these dropped messages? It's not the interface I was able to get this machine to accept 1200 msg/s with syslog-ng doing no filtering and writing to a fifo (with a script I wrote sucking messages though the pipe) plus /sbin/ifconfig tells me that things are ok.

In our investgation we decided to try the sync option to see if improved the situation where messages were dropped (this is happening with 100 test messages and a log_fifo_size(10000) ). We discovered that the remainder of messages left in the buffer were not flushed to the destination when syslog-ng was TERMed.

Looking at the change logs from 1.4.11 to 1.4.15 I don't see a fix mentioned there.

TERM more ore less immediately terminates syslog-ng, and doesn't wait for messages to be flushed. Try sending a -HUP first and then TERM, HUP flushes output buffers. I'll add a note to my 2.0 development tree, but I don't want to devote too much time to the old branches. I'm thinking about releasing 1.6.0 as syslog-ng 1.5.x seems to be quite stable. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1