Hello out there, I get loads of STATS: dropped: >0 and don't know why. I've got syslog-ng running on a central log host. Each host also has syslog-ng running. syslog-ng ist configured to use tcp instead of udp. In syslog-ng.conf I have right at the moment: options { long_hostnames(off); sync(10); log_fifo_size(1000); Playing around with sync and log_fifo_size doesn't change anything. syslog-ng is 1.6.0rc4 from Debian Testing. Has anybody any idea about this? Best Regards Manfred extract from syslog: Mar 9 10:02:10 www syslog-ng[302]: STATS: dropped 3 Mar 9 10:02:18 dns syslog-ng[31655]: STATS: dropped 7 Mar 9 10:02:26 bugzilla syslog-ng[31212]: STATS: dropped 3 Mar 9 10:02:27 proxy syslog-ng[32443]: STATS: dropped 3 Mar 9 10:02:38 mail syslog-ng[32293]: STATS: dropped 18 Mar 9 10:06:53 tux syslog-ng[1020]: STATS: dropped 178 Mar 9 10:05:07 brutus syslog-ng[23681]: STATS: dropped 61 Mar 9 10:12:18 dns syslog-ng[31655]: STATS: dropped 27 Mar 9 10:12:28 proxy syslog-ng[32443]: STATS: dropped 27 Mar 9 10:12:38 mail syslog-ng[32293]: STATS: dropped 84 Mar 9 10:16:54 tux syslog-ng[1020]: STATS: dropped 219 Mar 9 10:15:07 brutus syslog-ng[23681]: STATS: dropped 112 Mar 9 10:22:28 bugzilla syslog-ng[31212]: STATS: dropped 28 Mar 9 10:22:38 mail syslog-ng[32293]: STATS: dropped 60 Mar 9 10:26:54 tux syslog-ng[1020]: STATS: dropped 121 Mar 9 10:25:07 brutus syslog-ng[23681]: STATS: dropped 97 Mar 9 10:32:12 www syslog-ng[302]: STATS: dropped 27 Mar 9 10:32:38 mail syslog-ng[32293]: STATS: dropped 29 Mar 9 10:36:54 tux syslog-ng[1020]: STATS: dropped 248 Mar 9 10:35:07 brutus syslog-ng[23681]: STATS: dropped 80 Mar 9 10:42:38 mail syslog-ng[32293]: STATS: dropped 74 Mar 9 10:46:54 tux syslog-ng[1020]: STATS: dropped 92 Mar 9 10:45:08 brutus syslog-ng[23681]: STATS: dropped 15 Mar 9 10:52:38 mail syslog-ng[32293]: STATS: dropped 85 Mar 9 10:56:54 tux syslog-ng[1020]: STATS: dropped 201 Mar 9 10:55:09 brutus syslog-ng[23681]: STATS: dropped 135 -- manfred heubach edv und neue medien Hindenburgstr. 47 D-73728 Esslingen Tel. +49 711 9315824 Fax +49 711 9315825 www.heubach-edv.de Informationstechnologie und Telekommunikation für Unternehmen
2004-03-09, k keltezéssel 14:55-kor MH - Entwicklung ezt írta:
Hello out there,
I get loads of STATS: dropped: >0 and don't know why.
I've got syslog-ng running on a central log host. Each host also has syslog-ng running. syslog-ng ist configured to use tcp instead of udp.
it does not matter what you are using to receive messages. The value in STATS reports the number of messages "inside" syslog-ng, which is usually caused by some failing/slow destination. As file output never blocks, I suppose you have pipe/tcp/whatever destination that is too slow to process messages. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1
Balazs Scheidler wrote:
2004-03-09, k keltezéssel 14:55-kor MH - Entwicklung ezt írta:
Hello out there,
I get loads of STATS: dropped: >0 and don't know why.
I've got syslog-ng running on a central log host. Each host also has syslog-ng running. syslog-ng ist configured to use tcp instead of udp.
it does not matter what you are using to receive messages. The value in STATS reports the number of messages "inside" syslog-ng, which is usually caused by some failing/slow destination.
As file output never blocks, I suppose you have pipe/tcp/whatever destination that is too slow to process messages.
I have a destination xconsole (pipe) but no xconsole running. All other destinations are files. I will check this on friday and give a report. Thank's a lot Manfred -- manfred heubach edv und neue medien Hindenburgstr. 47 D-73728 Esslingen Tel. +49 711 9315824 Fax +49 711 9315825 www.heubach-edv.de Informationstechnologie und Telekommunikation für Unternehmen
Balazs Scheidler wrote:
2004-03-09, k keltezéssel 14:55-kor MH - Entwicklung ezt írta:
Hello out there,
I get loads of STATS: dropped: >0 and don't know why.
I've got syslog-ng running on a central log host. Each host also has syslog-ng running. syslog-ng ist configured to use tcp instead of udp.
it does not matter what you are using to receive messages. The value in STATS reports the number of messages "inside" syslog-ng, which is usually caused by some failing/slow destination.
As file output never blocks, I suppose you have pipe/tcp/whatever destination that is too slow to process messages.
Dear Balazs, you are right. After commenting out the pipes console and xconsole everything is working fine. Console is commented out only on our linux-vservers because they don't have a console. Thanks Manfred -- manfred heubach edv und neue medien Hindenburgstr. 47 D-73728 Esslingen Tel. +49 711 9315824 Fax +49 711 9315825 www.heubach-edv.de Informationstechnologie und Telekommunikation für Unternehmen
Balazs Scheidler wrote:
As file output never blocks, I suppose you have pipe/tcp/whatever destination that is too slow to process messages.
Might it not be useful to log which destination is having a problem or is that information not available? Or is there another way of obtaining this information? /Per Jessen, Zurich
2004-03-20, szo keltezéssel 12:28-kor Per Jessen ezt írta:
Balazs Scheidler wrote:
As file output never blocks, I suppose you have pipe/tcp/whatever destination that is too slow to process messages.
Might it not be useful to log which destination is having a problem or is that information not available? Or is there another way of obtaining this information?
currently this information is not available, that's why it is not logged. the STATS message was meant to be more general than what it is now, but there was no development in this area -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1
Hi All, I'm currently using syslog-ng on 8 of mta/mailhost machines which are logging via tcp to a central loghost/server.. Each machine generates over 1 gig of logs.. syslog-ng is eating away at system resouces in a big way, up to 40% of the cpu (local logging is disabled).. Is there any optimizations that can be made to try and chop down on cpu usage? Perhaps a higher sync() value? Its currently set to 0.. Regards, Cami
On Fri, Mar 26, 2004 at 09:51:24PM +0200, cami wrote:
Is there any optimizations that can be made to try and chop down on cpu usage? Perhaps a higher sync() value? Its currently set to 0..
Yes. Raise it to 1 or 2, you don't risk much log loss. -- Nate "C++: Hard to learn and built to stay that way."
participants (5)
-
Balazs Scheidler
-
cami
-
MH - Entwicklung
-
Nate Campi
-
Per Jessen