Problem with 1.6.3 on Solaris. Message
Looks like version 1.6.3 is not working well on Solaris 8. Few minutes after the start it generates hundreds of messages like: syslog.err syslog-ng[27013]: do_stream_read: STREAMS device gave too long line I think it is the result of changes related to HP-UX and pad_size (from 10k to 256 bytes ?) Another problem with syslog-ng in general (1.6.1 or later) - we're started to lose about 10% of syslog messages. The config file is not too big and messages do arrive on server for sure (confirmed with snoop) but every few minutes syslog-ng is losing some of them. Any recommendation on tuning or troubleshooting? Dmitri
2004-05-13, cs keltezéssel 09:35-kor Dmitri Smirnov ezt írta:
Looks like version 1.6.3 is not working well on Solaris 8.
Few minutes after the start it generates hundreds of messages like: syslog.err syslog-ng[27013]: do_stream_read: STREAMS device gave too long line
I think it is the result of changes related to HP-UX and pad_size (from 10k to 256 bytes ?)
Hmm.. no it should be caused by some IRIX related patches I applied to 1.6.3. I'll figure this out. Thanks for the report.
Another problem with syslog-ng in general (1.6.1 or later) - we're started to lose about 10% of syslog messages. The config file is not too big and messages do arrive on server for sure (confirmed with snoop) but every few minutes syslog-ng is losing some of them. Any recommendation on tuning or troubleshooting?
if the packet arrives to the log host but syslog-ng does not receive it (e.g. your STATS line shows 0 dropped messages), it is possible that the UDP receive buffer is too small. try increasing the UDP receive buffer, it should be possible with some OS dependant tools (ndd comes to mind on Solaris) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1
2004-05-13, cs keltezéssel 10:33-kor Balazs Scheidler ezt írta:
2004-05-13, cs keltezéssel 09:35-kor Dmitri Smirnov ezt írta:
Looks like version 1.6.3 is not working well on Solaris 8.
Few minutes after the start it generates hundreds of messages like: syslog.err syslog-ng[27013]: do_stream_read: STREAMS device gave too long line
I think it is the result of changes related to HP-UX and pad_size (from 10k to 256 bytes ?)
Hmm.. no it should be caused by some IRIX related patches I applied to 1.6.3. I'll figure this out. Thanks for the report.
Can you test if this patch fixes it? For me it seems to work. diff -u -r1.16.4.1 afstreams.c --- src/afstreams.c 10 Mar 2004 18:43:28 -0000 1.16.4.1 +++ src/afstreams.c 13 May 2004 11:31:10 -0000 @@ -175,6 +175,7 @@ struct nonblocking_fd *io_stream_get(struct io_backend *backend, int fd, UINT8 *hostname_re, + UINT32 max_log_line, struct log_handler *pipe) { NEW(stream_fd, f); @@ -184,6 +185,7 @@ f->super.read = stream_read_callback; f->super.want_read = 1; f->pipe = pipe; + f->max_log_line = max_log_line; if (hostname_re == NULL) regcomp(&f->bad_hostname, "^$", REG_NOSUB | REG_EXTENDED); else @@ -239,7 +241,7 @@ close(fd); return ST_FAIL | ST_QUIT; } - self->stream_fd = io_stream_get(cfg->backend, fd, cfg->bad_hostname, c); + self->stream_fd = io_stream_get(cfg->backend, fd, cfg->bad_hostname, cfg->log_msg_size, c); REMEMBER_RESOURCE(cfg->resources, &self->stream_fd->super); -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1
participants (2)
-
Balazs Scheidler
-
Dmitri Smirnov