-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, thanks for your answer, about the high load i have atached a top snapshot, so syslog-ng is the main application for this server. - -- Mit freundlichen Grüßen / With regards Stefan Schluppeck Bauer Publishinggroup - Brieffach 6200 - Burchard.11 - D-20077 Hamburg Publishing Support Center - Server & Development - Stefan Schluppeck Fon:+49-40-3019-5519 - Fax:+49-40-3019-5668 - eMail:sschluppeck@hbv.de ~ <°)))))>< ><)))))°> <°)))))>< ><)))))°> <°)))))>< ><)))))°> PGP-Fingerabdruck = 7DC1 E4B4 056C 5380 8C68 4B5F 5E87 227D 5632 E45F Key-ID = 81B7CD29 Balazs Scheidler wrote: | On Thu, 2004-10-28 at 14:50, Stefan Schluppeck wrote: | |>-----BEGIN PGP SIGNED MESSAGE----- |>Hash: SHA1 |> |>Hello, |> |>I have running a central syslog-ng under SLES9 (SuSE Linux Enterprice |>Server). |> |>ca. 90 Servers and 150 Network copunents are logging to this server |> |>I have some times "STATS: dropped 74625" and i have high load round |>about 11. |> |>What can i do, that no loglines are lost and the load is not so high? |> |>My global config: |>options { |>~ long_hostnames(off); |>~ sync(1024); |>~ log_fifo_size(300000); |>~ gc_busy_threshold(1000); |>~ gc_idle_threshold(30000); |>~ }; |> | | | Are you sure it is syslog-ng which generates the load? (because by | definition syslog-ng on its own can generate at most a load of 1) | | The STATS counter is incremented every time syslog-ng would have | something to write but the receiving side does not accept messages. | Probably you have a program/pipe/tcp destination not accepting messages | in a timely manner. | | Other tuning possibilities (though it affects receiving, not sending) is | to to disable DNS resolution and/or increase the UDP receive buffers. | -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFBgSKWXocifVYy5F8RAljvAKCXSiRBFTOePTdDg424oJyOoUw1XQCgpPP+ cLfzVAdA4e/ZorQrIRrqbpc= =b905 -----END PGP SIGNATURE-----