I've got a central logserver on syslog-ng and am getting the following in my logs: syslog-ng[26180]: Error accepting AF_UNIX connection, opened connections: 100, max: 100 but I clearly have source s_tcp { tcp( port(50514) max-connections(1000)); }; source s_udp { udp(); }; in my syslog-ng.conf and the server was restarted since this change (it was made a while ago). Can anybody tell me why this is? Is it possible that it's the udp which is hitting the 100 limit (I thought since udp was connectionless this would unlikely)? -- Hari Sekhon
On Mon, 2006-12-18 at 15:23 +0000, Hari Sekhon wrote:
I've got a central logserver on syslog-ng and am getting the following in my logs:
syslog-ng[26180]: Error accepting AF_UNIX connection, opened connections: 100, max: 100
AF_UNIX refers to unix domain sockets, e.g. you are probably hitting the maximum on unix-stream("/dev/log"); -- Bazsi
On Mon, Dec 18, 2006 at 07:24:47PM +0100, Balazs Scheidler wrote:
On Mon, 2006-12-18 at 15:23 +0000, Hari Sekhon wrote:
I've got a central logserver on syslog-ng and am getting the following in my logs:
syslog-ng[26180]: Error accepting AF_UNIX connection, opened connections: 100, max: 100
AF_UNIX refers to unix domain sockets, e.g. you are probably hitting the maximum on unix-stream("/dev/log");
Yup, either change it to: unix-dgram("/dev/log"); ...or: unix-stream("/dev/log" max-connections(200)); I see problems with /dev/log connections piling up when boxes are under high load, like 30+. When syslog-ng doesn't get enough CPU time to deal with incoming logs, you either have to move to unix-dgram and accept the possibility of message loss, or keep increasing the /dev/log connection limit and hope your boxes eventually catch up. :( -- Nate ASCII and ye shall receive.
On Tue, 2006-12-19 at 16:59 -0800, Nate Campi wrote:
On Mon, Dec 18, 2006 at 07:24:47PM +0100, Balazs Scheidler wrote:
On Mon, 2006-12-18 at 15:23 +0000, Hari Sekhon wrote:
I've got a central logserver on syslog-ng and am getting the following in my logs:
syslog-ng[26180]: Error accepting AF_UNIX connection, opened connections: 100, max: 100
AF_UNIX refers to unix domain sockets, e.g. you are probably hitting the maximum on unix-stream("/dev/log");
Yup, either change it to:
unix-dgram("/dev/log");
...or:
unix-stream("/dev/log" max-connections(200));
I see problems with /dev/log connections piling up when boxes are under high load, like 30+. When syslog-ng doesn't get enough CPU time to deal with incoming logs, you either have to move to unix-dgram and accept the possibility of message loss, or keep increasing the /dev/log connection limit and hope your boxes eventually catch up. :(
Or you could try playing with process priorities. -- Bazsi
the max-connections with unix-stream sorted it... thanks -h Hari Sekhon Balazs Scheidler wrote:
On Mon, 2006-12-18 at 15:23 +0000, Hari Sekhon wrote:
I've got a central logserver on syslog-ng and am getting the following in my logs:
syslog-ng[26180]: Error accepting AF_UNIX connection, opened connections: 100, max: 100
AF_UNIX refers to unix domain sockets, e.g. you are probably hitting the maximum on unix-stream("/dev/log");
participants (3)
-
Balazs Scheidler
-
Hari Sekhon
-
Nate Campi