why dose the usage of mem by syslog-ng keep growing?
the configure file as follows: options { use_dns(no); create_dirs(yes);ts_format(iso); }; #options { log_fifo_size(3000); }; source src { udp(ip(0.0.0.0) port(514) ); }; filter f_kern { facility(kern); }; filter f_authpriv { facility(auth,authpriv); }; filter f_mail { facility(mail); }; filter f_cron { facility(cron); }; filter f_boot { facility(local7); }; filter f_spooler { facility(uucp, news) and level(crit..emerg); }; filter f_messages { level(info..emerg) and not facility(authpriv, cron, mail); }; destination kern { file("/home/syslog-ng/$YEAR/$HOST/kernel-$MONTH"); }; destination authpriv { file("/home/syslog-ng/$YEAR/$HOST/secure-$MONTH"); }; destination mail { file("/home/syslog-ng/$YEAR/$HOST/maillog-$MONTH"); }; destination cron { file("/home/syslog-ng/$YEAR/$HOST/cron-$MONTH"); }; destination boot { file("/home/syslog-ng/$YEAR/$HOST/boot.log-$MONTH"); }; destination spooler { file("/home/syslog-ng/$YEAR/$HOST/spooler-$MONTH"); }; destination messages { file("/home/syslog-ng/$YEAR/$HOST/messages-$MONTH"); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_authpriv); destination(authpriv); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_boot); destination(boot); }; log { source(src); filter(f_spooler); destination(spooler); }; log { source(src); filter(f_messages); destination(messages); }; syslog-ng receive logs from about 1000 clients ,and the usage of mem by syslog-ng keeps growing,here are a days record of the usage of mem(got by command 'ps aux'): cup %mem 0.1 29.9 0.1 30.1 0.1 30.3 0.1 30.5 0.1 30.7 0.1 30.9 0.1 31.1 0.1 31.2 0.1 31.4 0.1 31.6 0.1 31.9 0.1 32.1 0.1 32.3 0.1 32.4 0.1 32.6 0.1 32.8 0.1 33.0 0.1 33.2 0.1 33.4 0.1 33.5 0.1 33.8 0.1 33.9 0.1 34.1 0.1 34.3 0.1 34.5 0.1 34.6 0.1 34.9 0.1 35.0 0.1 35.2
Hello,
the configure file as follows:
options { use_dns(no); create_dirs(yes);ts_format(iso); };
#options { log_fifo_size(3000); };
source src { udp(ip(0.0.0.0) port(514) ); };
filter f_kern { facility(kern); };
filter f_authpriv { facility(auth,authpriv); };
filter f_mail { facility(mail); };
filter f_cron { facility(cron); };
filter f_boot { facility(local7); };
filter f_spooler { facility(uucp, news) and level(crit..emerg); };
filter f_messages { level(info..emerg) and not facility(authpriv, cron, mail); };
destination kern { file("/home/syslog-ng/$YEAR/$HOST/kernel-$MONTH"); };
destination authpriv { file("/home/syslog-ng/$YEAR/$HOST/secure-$MONTH"); };
destination mail { file("/home/syslog-ng/$YEAR/$HOST/maillog-$MONTH"); };
destination cron { file("/home/syslog-ng/$YEAR/$HOST/cron-$MONTH"); };
destination boot { file("/home/syslog-ng/$YEAR/$HOST/boot.log-$MONTH"); };
destination spooler { file("/home/syslog-ng/$YEAR/$HOST/spooler-$MONTH"); };
destination messages { file("/home/syslog-ng/$YEAR/$HOST/messages-$MONTH"); };
log { source(src); filter(f_kern); destination(kern); };
log { source(src); filter(f_authpriv); destination(authpriv); };
log { source(src); filter(f_mail); destination(mail); };
log { source(src); filter(f_cron); destination(cron); };
log { source(src); filter(f_boot); destination(boot); };
log { source(src); filter(f_spooler); destination(spooler); };
log { source(src); filter(f_messages); destination(messages); };
syslog-ng receive logs from about 1000 clients ,and the usage of mem by syslog-ng keeps growing,here are a days record of the usage of mem(got by command 'ps aux'):
cup %mem
0.1 29.9
0.1 30.1
0.1 30.3
0.1 30.5
0.1 30.7
0.1 30.9
0.1 31.1
0.1 31.2
0.1 31.4
0.1 31.6
0.1 31.9
0.1 32.1
0.1 32.3
0.1 32.4
0.1 32.6
0.1 32.8
0.1 33.0
0.1 33.2
0.1 33.4
0.1 33.5
0.1 33.8
0.1 33.9
0.1 34.1
0.1 34.3
0.1 34.5
0.1 34.6
0.1 34.9
0.1 35.0
0.1 35.2
There was a similar thread a few days ago. Could you check whether the the memory usage actually grows when every destinations hit their configured log_fifo_size() values which default to 1000? It would be much better if you could show the actual memory footprint of syslog-ng, see the RSS column of ps's output. Regards, Sandor -------------------------------------------------------- NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.
Here are the actual memory footprint of syslog-ng,ps`s output: Time interval : Mon Sep 24 18:55:01 to Tue Sep 25 10:50:01 root 26087 0.2 0.0 10604 5292 ? Ss 18:29 0:00 syslog-ng root 26087 0.1 0.0 10604 5292 ? Rs 18:29 0:00 syslog-ng root 26087 0.1 0.1 13988 8748 ? Ss 18:29 0:01 syslog-ng root 26087 0.1 0.1 17112 11804 ? Ss 18:29 0:02 syslog-ng Mon Sep 24 18:55:01 CST 2007 root 26087 0.1 0.1 19588 14268 ? Ss 18:29 0:02 syslog-ng Mon Sep 24 19:00:01 CST 2007 root 26087 0.1 0.2 21800 16520 ? Ss 18:29 0:02 syslog-ng root 26087 0.2 0.2 28700 23376 ? Ss 18:29 0:04 syslog-ng Mon Sep 24 19:05:01 CST 2007 Mon Sep 24 19:10:01 CST 2007 root 26087 0.2 0.3 31036 25804 ? Ss 18:29 0:05 syslog-ng Mon Sep 24 19:15:01 CST 2007 root 26087 0.2 0.3 32080 26792 ? Ss 18:29 0:05 syslog-ng Mon Sep 24 19:20:02 CST 2007 root 26087 0.2 0.3 37536 32236 ? Rs 18:29 0:06 syslog-ng Mon Sep 24 19:25:01 CST 2007 root 26087 0.1 0.3 37536 32320 ? Ss 18:29 0:06 syslog-ng Mon Sep 24 19:30:01 CST 2007 root 26087 0.1 0.3 37796 32456 ? Rs 18:29 0:06 syslog-ng root 26087 0.1 0.4 41192 35868 ? Ss 18:29 0:07 syslog-ng Mon Sep 24 19:35:01 CST 2007 Mon Sep 24 19:40:01 CST 2007 root 26087 0.1 0.4 41716 36388 ? Ss 18:29 0:07 syslog-ng root 26087 0.1 0.4 44564 39284 ? Ss 18:29 0:08 syslog-ng Mon Sep 24 19:45:01 CST 2007 root 26087 0.1 0.5 48464 43156 ? Rs 18:29 0:08 syslog-ng Mon Sep 24 19:50:01 CST 2007 root 26087 0.1 0.5 50032 44772 ? Ss 18:29 0:09 syslog-ng Mon Sep 24 19:55:01 CST 2007 Mon Sep 24 20:00:01 CST 2007 root 26087 0.1 0.5 53160 47900 ? Ss 18:29 0:09 syslog-ng root 26087 0.2 0.6 59048 53780 ? Ss 18:29 0:11 syslog-ng Mon Sep 24 20:05:01 CST 2007 root 26087 0.1 0.6 62040 56792 ? Rs 18:29 0:11 syslog-ng Mon Sep 24 20:10:01 CST 2007 Mon Sep 24 20:15:01 CST 2007 root 26087 0.1 0.7 62432 57204 ? Ss 18:29 0:12 syslog-ng root 26087 0.1 0.7 64644 59312 ? Ss 18:29 0:12 syslog-ng Mon Sep 24 20:20:01 CST 2007 Mon Sep 24 20:25:01 CST 2007 root 26087 0.1 0.7 68036 62708 ? Ss 18:29 0:13 syslog-ng Mon Sep 24 20:30:01 CST 2007 root 26087 0.1 0.7 68420 63096 ? Ss 18:29 0:13 syslog-ng Mon Sep 24 20:35:01 CST 2007 root 26087 0.1 0.8 71548 66252 ? Ss 18:29 0:13 syslog-ng Mon Sep 24 20:40:01 CST 2007 root 26087 0.1 0.8 72328 67040 ? Ss 18:29 0:14 syslog-ng Mon Sep 24 20:45:01 CST 2007 root 26087 0.1 0.8 74920 69676 ? Ss 18:29 0:14 syslog-ng Mon Sep 24 20:50:01 CST 2007 root 26087 0.1 0.9 79232 74016 ? Ss 18:29 0:15 syslog-ng root 26087 0.1 0.9 80548 75260 ? Ss 18:29 0:15 syslog-ng Mon Sep 24 20:55:01 CST 2007 root 26087 0.1 0.9 80548 75260 ? Ss 18:29 0:15 syslog-ng Mon Sep 24 21:00:01 CST 2007 root 26087 0.1 1.0 87972 82688 ? Ss 18:29 0:17 syslog-ng Mon Sep 24 21:05:01 CST 2007 Mon Sep 24 21:10:01 CST 2007 root 26087 0.1 1.0 87972 82688 ? Rs 18:29 0:18 syslog-ng Mon Sep 24 21:15:01 CST 2007 root 26087 0.1 1.0 87972 82688 ? Ss 18:29 0:18 syslog-ng Mon Sep 24 21:20:01 CST 2007 root 26087 0.1 1.0 87972 82688 ? Ds 18:29 0:18 syslog-ng Mon Sep 24 21:25:01 CST 2007 root 26087 0.1 1.0 87972 82688 ? Ss 18:29 0:18 syslog-ng Mon Sep 24 21:30:01 CST 2007 root 26087 0.1 1.0 87972 82688 ? Ds 18:29 0:18 syslog-ng root 26087 0.1 1.0 88236 82952 ? Ss 18:29 0:18 syslog-ng Mon Sep 24 21:35:01 CST 2007 Mon Sep 24 21:40:01 CST 2007 root 26087 0.1 1.0 88368 83108 ? Ss 18:29 0:19 syslog-ng Mon Sep 24 21:45:01 CST 2007 root 26087 0.1 1.0 89920 84648 ? Ss 18:29 0:19 syslog-ng Mon Sep 24 21:50:02 CST 2007 root 26087 0.1 1.0 93704 88468 ? Rs 18:29 0:20 syslog-ng root 26087 0.1 1.0 94092 88800 ? Ss 18:29 0:20 syslog-ng Mon Sep 24 21:55:01 CST 2007 Mon Sep 24 22:00:01 CST 2007 root 26087 0.1 1.0 94092 88800 ? Ds 18:29 0:20 syslog-ng Mon Sep 24 22:05:01 CST 2007 root 26087 0.1 1.1 97232 91964 ? Ss 18:29 0:22 syslog-ng root 26087 0.1 1.1 97360 92096 ? Ss 18:29 0:23 syslog-ng Mon Sep 24 22:10:01 CST 2007 Mon Sep 24 22:15:01 CST 2007 root 26087 0.1 1.1 100608 95336 ? Ss 18:29 0:23 syslog-ng root 26087 0.1 1.2 104384 99080 ? Rs 18:29 0:24 syslog-ng Mon Sep 24 22:20:01 CST 2007 Mon Sep 24 22:25:01 CST 2007 root 26087 0.1 1.2 106076 100852 ? Ss 18:29 0:24 syslog-ng Mon Sep 24 22:30:01 CST 2007 root 26087 0.1 1.2 108420 103124 ? Ss 18:29 0:24 syslog-ng root 26087 0.1 1.2 109720 104416 ? Ss 18:29 0:25 syslog-ng Mon Sep 24 22:35:01 CST 2007 Mon Sep 24 22:40:01 CST 2007 root 26087 0.1 1.3 112460 107212 ? Ss 18:29 0:25 syslog-ng Mon Sep 24 22:45:01 CST 2007 root 26087 0.1 1.3 113104 107868 ? Ss 18:29 0:26 syslog-ng root 26087 0.1 1.3 115196 109984 ? Ss 18:29 0:26 syslog-ng Mon Sep 24 22:50:01 CST 2007 root 26087 0.1 1.3 118604 113380 ? Ss 18:29 0:27 syslog-ng Mon Sep 24 22:55:01 CST 2007 Mon Sep 24 23:00:01 CST 2007 root 26087 0.1 1.3 119392 114076 ? Ss 18:29 0:27 syslog-ng root 26087 0.1 1.4 125908 120676 ? Rs 18:29 0:29 syslog-ng Mon Sep 24 23:05:01 CST 2007 root 26087 0.1 1.4 126816 121580 ? Rs 18:29 0:29 syslog-ng Mon Sep 24 23:10:01 CST 2007 Mon Sep 24 23:15:01 CST 2007 root 26087 0.1 1.5 129416 124100 ? Ss 18:29 0:30 syslog-ng Mon Sep 24 23:20:01 CST 2007 root 26087 0.1 1.5 133988 128760 ? Ss 18:29 0:31 syslog-ng root 26087 0.1 1.5 135032 129704 ? Ss 18:29 0:31 syslog-ng Mon Sep 24 23:25:01 CST 2007 Mon Sep 24 23:30:01 CST 2007 root 26087 0.1 1.5 135032 129704 ? Ss 18:29 0:31 syslog-ng Mon Sep 24 23:35:01 CST 2007 root 26087 0.1 1.6 138408 133176 ? Ss 18:29 0:32 syslog-ng root 26087 0.1 1.6 138408 133176 ? Ss 18:29 0:32 syslog-ng Mon Sep 24 23:40:01 CST 2007 Mon Sep 24 23:45:01 CST 2007 root 26087 0.1 1.6 141916 136588 ? Ss 18:29 0:32 syslog-ng Mon Sep 24 23:50:01 CST 2007 root 26087 0.1 1.7 144652 139420 ? Ss 18:29 0:33 syslog-ng root 26087 0.1 1.7 149476 144224 ? Ss 18:29 0:34 syslog-ng Mon Sep 24 23:55:01 CST 2007 Tue Sep 25 00:00:01 CST 2007 root 26087 0.1 1.7 151692 146456 ? Ss Sep24 0:34 syslog-ng Tue Sep 25 00:05:01 CST 2007 root 26087 0.1 1.8 157048 151788 ? Ss Sep24 0:36 syslog-ng Tue Sep 25 00:10:01 CST 2007 root 26087 0.1 1.8 159252 153960 ? Ss Sep24 0:37 syslog-ng Tue Sep 25 00:15:01 CST 2007 root 26087 0.1 1.9 160552 155280 ? Ss Sep24 0:37 syslog-ng Tue Sep 25 00:20:02 CST 2007 root 26087 0.1 1.9 165916 160688 ? Ss Sep24 0:38 syslog-ng Tue Sep 25 00:25:01 CST 2007 root 26087 0.1 1.9 166044 160812 ? Ss Sep24 0:38 syslog-ng root 26087 0.1 1.9 166304 161052 ? Rs Sep24 0:38 syslog-ng Tue Sep 25 00:30:01 CST 2007 Tue Sep 25 00:35:01 CST 2007 root 26087 0.1 2.0 169708 164372 ? Ss Sep24 0:39 syslog-ng Tue Sep 25 00:40:01 CST 2007 root 26087 0.1 2.0 170356 165096 ? Ss Sep24 0:39 syslog-ng Tue Sep 25 00:45:01 CST 2007 root 26087 0.1 2.0 173092 167804 ? Ss Sep24 0:40 syslog-ng Tue Sep 25 00:50:01 CST 2007 root 26087 0.1 2.1 177136 171796 ? Ss Sep24 0:40 syslog-ng Tue Sep 25 00:55:01 CST 2007 root 26087 0.1 2.1 178576 173320 ? Ss Sep24 0:41 syslog-ng Tue Sep 25 01:00:01 CST 2007 root 26087 0.1 2.1 181816 176508 ? Ss Sep24 0:41 syslog-ng root 26087 0.1 2.2 185988 180676 ? Ss Sep24 0:43 syslog-ng Tue Sep 25 01:05:01 CST 2007 Tue Sep 25 01:10:01 CST 2007 root 26087 0.1 2.2 185988 180676 ? Ss Sep24 0:43 syslog-ng root 26087 0.1 2.2 189372 184048 ? Ss Sep24 0:44 syslog-ng Tue Sep 25 01:15:01 CST 2007 Tue Sep 25 01:20:01 CST 2007 root 26087 0.1 2.2 191720 186464 ? Rs Sep24 0:44 syslog-ng root 26087 0.1 2.3 194856 189568 ? Ss Sep24 0:45 syslog-ng Tue Sep 25 01:25:01 CST 2007 Tue Sep 25 01:30:01 CST 2007 root 26087 0.1 2.3 196284 191032 ? Rs Sep24 0:45 syslog-ng Tue Sep 25 01:35:01 CST 2007 root 26087 0.1 2.3 198492 193268 ? Ss Sep24 0:46 syslog-ng Tue Sep 25 01:40:01 CST 2007 root 26087 0.1 2.3 200184 194932 ? Ss Sep24 0:46 syslog-ng Tue Sep 25 01:45:01 CST 2007 root 26087 0.1 2.4 202012 196700 ? Ss Sep24 0:46 syslog-ng Tue Sep 25 01:50:01 CST 2007 root 26087 0.1 2.4 207084 201824 ? Ss Sep24 0:47 syslog-ng root 26087 0.1 2.4 207472 202236 ? Ss Sep24 0:48 syslog-ng Tue Sep 25 01:55:01 CST 2007 Tue Sep 25 02:00:01 CST 2007 root 26087 0.1 2.4 207472 202236 ? Ss Sep24 0:48 syslog-ng root 26087 0.1 2.5 215688 210408 ? Ss Sep24 0:50 syslog-ng Tue Sep 25 02:05:01 CST 2007 Tue Sep 25 02:10:01 CST 2007 root 26087 0.1 2.5 215820 210552 ? Ss Sep24 0:50 syslog-ng Tue Sep 25 02:15:01 CST 2007 root 26087 0.1 2.6 219080 213836 ? Ss Sep24 0:51 syslog-ng root 26087 0.1 2.6 222720 217452 ? Ss Sep24 0:51 syslog-ng Tue Sep 25 02:20:01 CST 2007 root 26087 0.1 2.6 224684 219368 ? Ss Sep24 0:52 syslog-ng Tue Sep 25 02:25:01 CST 2007 Tue Sep 25 02:30:01 CST 2007 root 26087 0.1 2.7 227156 221864 ? Ss Sep24 0:52 syslog-ng root 26087 0.1 2.7 228196 222892 ? Ss Sep24 0:53 syslog-ng Tue Sep 25 02:35:01 CST 2007 Tue Sep 25 02:40:01 CST 2007 root 26087 0.1 2.7 231060 225788 ? Ss Sep24 0:53 syslog-ng Tue Sep 25 02:45:01 CST 2007 root 26087 0.1 2.7 231576 226300 ? Ss Sep24 0:53 syslog-ng Tue Sep 25 02:50:01 CST 2007 root 26087 0.1 2.7 233660 228424 ? Rs Sep24 0:54 syslog-ng Tue Sep 25 02:55:01 CST 2007 root 26087 0.1 2.8 237044 231780 ? Ss Sep24 0:54 syslog-ng Tue Sep 25 03:00:01 CST 2007 root 26087 0.1 2.8 237700 232484 ? Ss Sep24 0:55 syslog-ng Tue Sep 25 03:05:01 CST 2007 root 26087 0.1 2.9 245132 239888 ? Ss Sep24 0:57 syslog-ng Tue Sep 25 03:10:01 CST 2007 root 26087 0.1 2.9 246300 241044 ? Ss Sep24 0:57 syslog-ng Tue Sep 25 03:15:01 CST 2007 root 26087 0.1 2.9 248644 243312 ? Ss Sep24 0:58 syslog-ng Tue Sep 25 03:20:01 CST 2007 root 26087 0.1 3.0 253068 247788 ? Ss Sep24 0:58 syslog-ng Tue Sep 25 03:25:01 CST 2007 root 26087 0.1 3.0 254108 248844 ? Ss Sep24 0:59 syslog-ng root 26087 0.1 3.0 257376 252112 ? Ss Sep24 0:59 syslog-ng Tue Sep 25 03:30:01 CST 2007 root 26087 0.1 3.0 257636 252420 ? Ss Sep24 1:00 syslog-ng Tue Sep 25 03:35:01 CST 2007 Tue Sep 25 03:40:01 CST 2007 root 26087 0.1 3.0 257636 252420 ? Ss Sep24 1:00 syslog-ng Tue Sep 25 03:45:01 CST 2007 root 26087 0.1 3.1 261156 255844 ? Ss Sep24 1:00 syslog-ng Tue Sep 25 03:50:01 CST 2007 root 26087 0.1 3.1 263628 258412 ? Ss Sep24 1:01 syslog-ng Tue Sep 25 03:55:01 CST 2007 root 26087 0.1 3.2 266612 261380 ? Ss Sep24 1:01 syslog-ng root 26087 0.1 3.2 268300 263020 ? Ss Sep24 1:02 syslog-ng Tue Sep 25 04:00:01 CST 2007 Tue Sep 25 04:05:01 CST 2007 root 26087 0.1 3.3 282776 277532 ? Ss Sep24 1:06 syslog-ng root 26087 0.1 3.4 284860 279532 ? Ss Sep24 1:06 syslog-ng Tue Sep 25 04:10:01 CST 2007 root 26087 0.1 3.4 286156 280932 ? Ss Sep24 1:06 syslog-ng Tue Sep 25 04:15:01 CST 2007 Tue Sep 25 04:20:01 CST 2007 root 26087 0.1 3.5 291368 286148 ? Ss Sep24 1:07 syslog-ng root 26087 0.1 3.5 291756 286424 ? Ss Sep24 1:07 syslog-ng Tue Sep 25 04:25:01 CST 2007 root 26087 0.1 3.5 291756 286428 ? Rs Sep24 1:08 syslog-ng Tue Sep 25 04:30:01 CST 2007 root 26087 0.1 3.5 295260 289976 ? Ss Sep24 1:08 syslog-ng Tue Sep 25 04:35:01 CST 2007 Tue Sep 25 04:40:01 CST 2007 root 26087 0.1 3.5 295388 290080 ? Ss Sep24 1:09 syslog-ng root 26087 0.1 3.5 298668 293388 ? Ss Sep24 1:09 syslog-ng Tue Sep 25 04:45:01 CST 2007 Tue Sep 25 04:50:01 CST 2007 root 26087 0.1 3.6 302176 296856 ? Ss Sep24 1:10 syslog-ng Tue Sep 25 04:55:01 CST 2007 root 26087 0.1 3.6 304248 298912 ? Ss Sep24 1:10 syslog-ng Tue Sep 25 05:00:01 CST 2007 root 26087 0.1 3.6 306856 301532 ? Ss Sep24 1:11 syslog-ng root 26087 0.1 3.7 312328 307088 ? Ss Sep24 1:13 syslog-ng Tue Sep 25 05:05:01 CST 2007 Tue Sep 25 05:10:01 CST 2007 root 26087 0.1 3.7 315196 309924 ? Rs Sep24 1:13 syslog-ng Tue Sep 25 05:15:01 CST 2007 root 26087 0.1 3.8 315712 310496 ? Ss Sep24 1:13 syslog-ng Tue Sep 25 05:20:01 CST 2007 root 26087 0.1 3.8 317936 312620 ? Ss Sep24 1:14 syslog-ng root 26087 0.1 3.8 321336 316040 ? Ss Sep24 1:15 syslog-ng Tue Sep 25 05:25:01 CST 2007 root 26087 0.1 3.8 321856 316544 ? Rs Sep24 1:15 syslog-ng Tue Sep 25 05:30:01 CST 2007 root 26087 0.1 3.9 324860 319624 ? Ss Sep24 1:16 syslog-ng Tue Sep 25 05:35:01 CST 2007 root 26087 0.1 3.9 325900 320628 ? Ss Sep24 1:16 syslog-ng Tue Sep 25 05:40:01 CST 2007 Tue Sep 25 05:45:01 CST 2007 root 26087 0.1 3.9 328356 323060 ? Ss Sep24 1:16 syslog-ng root 26087 0.1 4.0 332804 327552 ? Rs Sep24 1:17 syslog-ng Tue Sep 25 05:50:01 CST 2007 Tue Sep 25 05:55:01 CST 2007 root 26087 0.1 4.0 333856 328560 ? Ss Sep24 1:17 syslog-ng Tue Sep 25 06:00:01 CST 2007 root 26087 0.1 4.0 337380 332136 ? Ss Sep24 1:18 syslog-ng Tue Sep 25 06:05:01 CST 2007 root 26087 0.1 4.1 341944 336728 ? Ss Sep24 1:20 syslog-ng Tue Sep 25 06:10:01 CST 2007 root 26087 0.1 4.1 341944 336728 ? Rs Sep24 1:20 syslog-ng root 26087 0.1 4.1 345452 340120 ? Ss Sep24 1:21 syslog-ng Tue Sep 25 06:15:01 CST 2007 Tue Sep 25 06:20:01 CST 2007 root 26087 0.1 4.1 347936 342648 ? Ss Sep24 1:21 syslog-ng Tue Sep 25 06:25:01 CST 2007 root 26087 0.1 4.2 350940 345620 ? Rs Sep24 1:22 syslog-ng root 26087 0.1 4.2 352508 347216 ? Ss Sep24 1:22 syslog-ng Tue Sep 25 06:30:01 CST 2007 root 26087 0.1 4.2 354456 349180 ? Ss Sep24 1:23 syslog-ng Tue Sep 25 06:35:01 CST 2007 Tue Sep 25 06:40:01 CST 2007 root 26087 0.1 4.3 356420 351156 ? Ss Sep24 1:23 syslog-ng root 26087 0.1 4.3 357844 352600 ? Ss Sep24 1:23 syslog-ng Tue Sep 25 06:45:01 CST 2007 root 26087 0.1 4.3 363196 357876 ? Ss Sep24 1:24 syslog-ng Tue Sep 25 06:50:01 CST 2007 Tue Sep 25 06:55:01 CST 2007 root 26087 0.1 4.3 363456 358152 ? Ss Sep24 1:25 syslog-ng root 26087 0.1 4.3 363456 358156 ? Rs Sep24 1:25 syslog-ng Tue Sep 25 07:00:01 CST 2007 Tue Sep 25 07:05:01 CST 2007 root 26087 0.1 4.4 371276 365988 ? Ss Sep24 1:27 syslog-ng Tue Sep 25 07:10:01 CST 2007 root 26087 0.1 4.4 371408 366164 ? Rs Sep24 1:27 syslog-ng root 26087 0.1 4.5 374672 369408 ? Ss Sep24 1:28 syslog-ng Tue Sep 25 07:15:01 CST 2007 Tue Sep 25 07:20:01 CST 2007 root 26087 0.1 4.5 378056 372720 ? Rs Sep24 1:29 syslog-ng Tue Sep 25 07:25:01 CST 2007 root 26087 0.1 4.5 380256 374964 ? Ss Sep24 1:29 syslog-ng root 26087 0.1 4.6 382464 377164 ? Ss Sep24 1:30 syslog-ng Tue Sep 25 07:30:01 CST 2007 Tue Sep 25 07:35:01 CST 2007 root 26087 0.1 4.6 383764 378520 ? Ss Sep24 1:30 syslog-ng Tue Sep 25 07:40:01 CST 2007 root 26087 0.1 4.6 386616 381364 ? Rs Sep24 1:31 syslog-ng Tue Sep 25 07:45:01 CST 2007 root 26087 0.1 4.6 387268 381952 ? Ss Sep24 1:31 syslog-ng Tue Sep 25 07:50:01 CST 2007 root 26087 0.1 4.7 389364 384076 ? Rs Sep24 1:31 syslog-ng root 26087 0.1 4.7 392756 387436 ? Ss Sep24 1:32 syslog-ng Tue Sep 25 07:55:01 CST 2007 Tue Sep 25 08:00:01 CST 2007 root 26087 0.1 4.7 393144 387876 ? Rs Sep24 1:32 syslog-ng Tue Sep 25 08:05:01 CST 2007 root 26087 0.1 4.8 400700 395444 ? Ss Sep24 1:35 syslog-ng Tue Sep 25 08:10:01 CST 2007 root 26087 0.1 4.8 401600 396340 ? Rs Sep24 1:35 syslog-ng Tue Sep 25 08:15:01 CST 2007 root 26087 0.1 4.8 404196 398864 ? Ss Sep24 1:35 syslog-ng Tue Sep 25 08:20:01 CST 2007 root 26087 0.1 4.9 408356 403032 ? Ss Sep24 1:36 syslog-ng root 26087 0.1 4.9 409648 404392 ? Ss Sep24 1:36 syslog-ng Tue Sep 25 08:25:01 CST 2007 Tue Sep 25 08:30:01 CST 2007 root 26087 0.1 4.9 412648 407360 ? Ss Sep24 1:37 syslog-ng root 26087 0.1 4.9 413168 407956 ? Ss Sep24 1:37 syslog-ng Tue Sep 25 08:35:02 CST 2007 root 26087 0.1 4.9 413168 407956 ? Ss Sep24 1:37 syslog-ng Tue Sep 25 08:40:01 CST 2007 Tue Sep 25 08:45:01 CST 2007 root 26087 0.1 5.0 416700 411392 ? Ss Sep24 1:38 syslog-ng Tue Sep 25 08:50:01 CST 2007 root 26087 0.1 5.0 419172 413876 ? Ss Sep24 1:39 syslog-ng Tue Sep 25 08:55:01 CST 2007 root 26087 0.1 5.1 422168 416932 ? Ss Sep24 1:39 syslog-ng root 26087 0.1 5.1 423340 418096 ? Rs Sep24 1:40 syslog-ng Tue Sep 25 09:00:01 CST 2007 Tue Sep 25 09:05:01 CST 2007 root 26087 0.1 5.1 429708 424408 ? Ss Sep24 1:42 syslog-ng Tue Sep 25 09:10:01 CST 2007 root 26087 0.1 5.2 431284 425956 ? Ss Sep24 1:42 syslog-ng Tue Sep 25 09:15:01 CST 2007 root 26087 0.1 5.2 433112 427836 ? Ss Sep24 1:42 syslog-ng Tue Sep 25 09:20:01 CST 2007 root 26087 0.1 5.3 438200 432924 ? Ss Sep24 1:43 syslog-ng Tue Sep 25 09:25:01 CST 2007 root 26087 0.1 5.3 438592 433352 ? Ss Sep24 1:44 syslog-ng root 26087 0.1 5.3 438592 433352 ? Rs Sep24 1:44 syslog-ng Tue Sep 25 09:30:01 CST 2007 Tue Sep 25 09:35:01 CST 2007 root 26087 0.1 5.3 442228 436900 ? Ss Sep24 1:44 syslog-ng Tue Sep 25 09:40:01 CST 2007 root 26087 0.1 5.3 442228 436904 ? Ss Sep24 1:45 syslog-ng Tue Sep 25 09:45:01 CST 2007 root 26087 0.1 5.3 445636 440316 ? Rs Sep24 1:45 syslog-ng Tue Sep 25 09:50:01 CST 2007 root 26087 0.1 5.4 448904 443568 ? Ss Sep24 1:46 syslog-ng root 26087 0.1 5.4 451116 445872 ? Ss Sep24 1:46 syslog-ng Tue Sep 25 09:55:01 CST 2007 root 26087 0.1 5.4 453336 448108 ? Rs Sep24 1:47 syslog-ng Tue Sep 25 10:00:01 CST 2007 Tue Sep 25 10:05:01 CST 2007 root 26087 0.1 5.5 458420 453112 ? Ss Sep24 1:49 syslog-ng root 26087 0.1 5.5 461012 455724 ? Ss Sep24 1:49 syslog-ng Tue Sep 25 10:10:01 CST 2007 root 26087 0.1 5.5 461796 456536 ? Ss Sep24 1:50 syslog-ng Tue Sep 25 10:15:01 CST 2007 root 26087 0.1 5.6 464004 458672 ? Rs Sep24 1:50 syslog-ng Tue Sep 25 10:20:01 CST 2007 root 26087 0.1 5.6 467384 462092 ? Ss Sep24 1:51 syslog-ng Tue Sep 25 10:25:01 CST 2007 Tue Sep 25 10:30:01 CST 2007 root 26087 0.1 5.6 467644 462304 ? Rs Sep24 1:51 syslog-ng Tue Sep 25 10:35:01 CST 2007 root 26087 0.1 5.7 470900 465648 ? Ss Sep24 1:52 syslog-ng Tue Sep 25 10:40:01 CST 2007 root 26087 0.1 5.7 471544 466296 ? Ss Sep24 1:52 syslog-ng Tue Sep 25 10:45:01 CST 2007 root 26087 0.1 5.7 474408 469076 ? Ss Sep24 1:53 syslog-ng root 26087 0.1 5.7 478568 473272 ? Rs Sep24 1:53 syslog-ng Tue Sep 25 10:50:01 CST 2007 -----邮件原件----- 发件人: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] 代表 Geller, Sandor (IT) 发送时间: 2007年9月24日 16:28 收件人: Syslog-ng users' and developers' mailing list 主题: Re: [syslog-ng] why dose the usage of mem by syslog-ng keep growing? Hello,
the configure file as follows:
options { use_dns(no); create_dirs(yes);ts_format(iso); };
#options { log_fifo_size(3000); };
source src { udp(ip(0.0.0.0) port(514) ); };
filter f_kern { facility(kern); };
filter f_authpriv { facility(auth,authpriv); };
filter f_mail { facility(mail); };
filter f_cron { facility(cron); };
filter f_boot { facility(local7); };
filter f_spooler { facility(uucp, news) and level(crit..emerg); };
filter f_messages { level(info..emerg) and not facility(authpriv, cron, mail); };
destination kern { file("/home/syslog-ng/$YEAR/$HOST/kernel-$MONTH"); };
destination authpriv { file("/home/syslog-ng/$YEAR/$HOST/secure-$MONTH"); };
destination mail { file("/home/syslog-ng/$YEAR/$HOST/maillog-$MONTH"); };
destination cron { file("/home/syslog-ng/$YEAR/$HOST/cron-$MONTH"); };
destination boot { file("/home/syslog-ng/$YEAR/$HOST/boot.log-$MONTH"); };
destination spooler { file("/home/syslog-ng/$YEAR/$HOST/spooler-$MONTH"); };
destination messages { file("/home/syslog-ng/$YEAR/$HOST/messages-$MONTH"); };
log { source(src); filter(f_kern); destination(kern); };
log { source(src); filter(f_authpriv); destination(authpriv); };
log { source(src); filter(f_mail); destination(mail); };
log { source(src); filter(f_cron); destination(cron); };
log { source(src); filter(f_boot); destination(boot); };
log { source(src); filter(f_spooler); destination(spooler); };
log { source(src); filter(f_messages); destination(messages); };
syslog-ng receive logs from about 1000 clients ,and the usage of mem by syslog-ng keeps growing,here are a days record of the usage of mem(got by command 'ps aux'):
cup %mem
0.1 29.9
0.1 30.1
0.1 30.3
0.1 30.5
0.1 30.7
0.1 30.9
0.1 31.1
0.1 31.2
0.1 31.4
0.1 31.6
0.1 31.9
0.1 32.1
0.1 32.3
0.1 32.4
0.1 32.6
0.1 32.8
0.1 33.0
0.1 33.2
0.1 33.4
0.1 33.5
0.1 33.8
0.1 33.9
0.1 34.1
0.1 34.3
0.1 34.5
0.1 34.6
0.1 34.9
0.1 35.0
0.1 35.2
There was a similar thread a few days ago. Could you check whether the the memory usage actually grows when every destinations hit their configured log_fifo_size() values which default to 1000? It would be much better if you could show the actual memory footprint of syslog-ng, see the RSS column of ps's output. Regards, Sandor -------------------------------------------------------- NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error. _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
On Tue, 2007-09-25 at 11:11 +0800, liuruihong wrote:
Here are the actual memory footprint of syslog-ng,ps`s output: Time interval : Mon Sep 24 18:55:01 to Tue Sep 25 10:50:01 root 26087 0.2 0.0 10604 5292 ? Ss 18:29 0:00 syslog-ng root 26087 0.1 0.0 10604 5292 ? Rs 18:29 0:00 syslog-ng root 26087 0.1 0.1 13988 8748 ? Ss 18:29 0:01 syslog-ng
This seems to be a lot indeed. Can you send us your configuration file to see what might be specific in your deployment? And could you also tell us the version of syslog-ng you are using? If this information is not enough to narrow down the problem I might need a core file of syslog-ng, but let's see the info first.
root 26087 0.1 0.1 17112 11804 ? Ss 18:29 0:02 syslog-ng Mon Sep 24 18:55:01 CST 2007 -- Bazsi
The version of syslog-ng is 2.0.5 the configure file as follows： options { use_dns(no); create_dirs(yes);ts_format(iso); }; #options { log_fifo_size(3000); }; source src { udp(ip(0.0.0.0) port(514) ); }; filter f_kern { facility(kern); }; filter f_authpriv { facility(auth,authpriv); }; filter f_mail { facility(mail); }; filter f_cron { facility(cron); }; filter f_boot { facility(local7); }; filter f_spooler { facility(uucp, news) and level(crit..emerg); }; filter f_messages { level(info..emerg) and not facility(authpriv, cron, mail); }; #destination kern { file("/home/syslog-ng/$YEAR/$HOST/kernel-$MONTH"); }; #destination authpriv { file("/home/syslog-ng/$YEAR/$HOST/secure-$MONTH"); }; #destination mail { file("/home/syslog-ng/$YEAR/$HOST/maillog-$MONTH"); }; #destination cron { file("/home/syslog-ng/$YEAR/$HOST/cron-$MONTH"); }; #destination boot { file("/home/syslog-ng/$YEAR/$HOST/boot.log-$MONTH"); }; #destination spooler { file("/home/syslog-ng/$YEAR/$HOST/spooler-$MONTH"); }; #destination messages { file("/home/syslog-ng/$YEAR/$HOST/messages-$MONTH"); }; destination kern { file("/home/syslog-ng/$YEAR/$HOST/kernel-$HOUR"); }; destination authpriv { file("/home/syslog-ng/$YEAR/$HOST/secure-$HOUR"); }; destination mail { file("/home/syslog-ng/$YEAR/$HOST/maillog-$HOUR"); }; destination cron { file("/home/syslog-ng/$YEAR/$HOST/cron-$HOUR"); }; destination boot { file("/home/syslog-ng/$YEAR/$HOST/boot.log-$HOUR"); }; destination spooler { file("/home/syslog-ng/$YEAR/$HOST/spooler-$HOUR"); }; destination messages { file("/home/syslog-ng/$YEAR/$HOST/messages-$HOUR"); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_authpriv); destination(authpriv); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_boot); destination(boot); }; log { source(src); filter(f_spooler); destination(spooler); }; log { source(src); filter(f_messages); destination(messages); }; -----邮件原件----- 发件人: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] 代表 Balazs Scheidler 发送时间: 2007年9月25日 14:15 收件人: Syslog-ng users' and developers' mailing list 主题: Re: [syslog-ng] 答复: why dose the usage of mem by syslog-ng keep growing? On Tue, 2007-09-25 at 11:11 +0800, liuruihong wrote:
Here are the actual memory footprint of syslog-ng,ps`s output: Time interval : Mon Sep 24 18:55:01 to Tue Sep 25 10:50:01 root 26087 0.2 0.0 10604 5292 ? Ss 18:29 0:00 syslog-ng root 26087 0.1 0.0 10604 5292 ? Rs 18:29 0:00 syslog-ng root 26087 0.1 0.1 13988 8748 ? Ss 18:29 0:01 syslog-ng
This seems to be a lot indeed. Can you send us your configuration file to see what might be specific in your deployment? And could you also tell us the version of syslog-ng you are using? If this information is not enough to narrow down the problem I might need a core file of syslog-ng, but let's see the info first.
root 26087 0.1 0.1 17112 11804 ? Ss 18:29 0:02 syslog-ng Mon Sep 24 18:55:01 CST 2007 -- Bazsi
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
In addition the syslog-ng receive logs from about 1000 clients when the usage of mem by syslog-ng keep growing I think maybe the reason of the problem is that there are so many log files being writted . I do another test ,using the same verson and the configure file,but receives logs from only one client,and usage of mem by syslog-ng doesn`t keep growing. But I don`t know the relationship between them. -----邮件原件----- 发件人: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] 代表 liuruihong 发送时间: 2007年9月25日 14:23 收件人: 'Syslog-ng users' and developers' mailing list' 主题: [syslog-ng] 答复: 答复: why dose the usage of mem by syslog-ng keep growing? The version of syslog-ng is 2.0.5 the configure file as follows： options { use_dns(no); create_dirs(yes);ts_format(iso); }; #options { log_fifo_size(3000); }; source src { udp(ip(0.0.0.0) port(514) ); }; filter f_kern { facility(kern); }; filter f_authpriv { facility(auth,authpriv); }; filter f_mail { facility(mail); }; filter f_cron { facility(cron); }; filter f_boot { facility(local7); }; filter f_spooler { facility(uucp, news) and level(crit..emerg); }; filter f_messages { level(info..emerg) and not facility(authpriv, cron, mail); }; #destination kern { file("/home/syslog-ng/$YEAR/$HOST/kernel-$MONTH"); }; #destination authpriv { file("/home/syslog-ng/$YEAR/$HOST/secure-$MONTH"); }; #destination mail { file("/home/syslog-ng/$YEAR/$HOST/maillog-$MONTH"); }; #destination cron { file("/home/syslog-ng/$YEAR/$HOST/cron-$MONTH"); }; #destination boot { file("/home/syslog-ng/$YEAR/$HOST/boot.log-$MONTH"); }; #destination spooler { file("/home/syslog-ng/$YEAR/$HOST/spooler-$MONTH"); }; #destination messages { file("/home/syslog-ng/$YEAR/$HOST/messages-$MONTH"); }; destination kern { file("/home/syslog-ng/$YEAR/$HOST/kernel-$HOUR"); }; destination authpriv { file("/home/syslog-ng/$YEAR/$HOST/secure-$HOUR"); }; destination mail { file("/home/syslog-ng/$YEAR/$HOST/maillog-$HOUR"); }; destination cron { file("/home/syslog-ng/$YEAR/$HOST/cron-$HOUR"); }; destination boot { file("/home/syslog-ng/$YEAR/$HOST/boot.log-$HOUR"); }; destination spooler { file("/home/syslog-ng/$YEAR/$HOST/spooler-$HOUR"); }; destination messages { file("/home/syslog-ng/$YEAR/$HOST/messages-$HOUR"); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_authpriv); destination(authpriv); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_boot); destination(boot); }; log { source(src); filter(f_spooler); destination(spooler); }; log { source(src); filter(f_messages); destination(messages); }; -----邮件原件----- 发件人: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] 代表 Balazs Scheidler 发送时间: 2007年9月25日 14:15 收件人: Syslog-ng users' and developers' mailing list 主题: Re: [syslog-ng] 答复: why dose the usage of mem by syslog-ng keep growing? On Tue, 2007-09-25 at 11:11 +0800, liuruihong wrote:
Here are the actual memory footprint of syslog-ng,ps`s output: Time interval : Mon Sep 24 18:55:01 to Tue Sep 25 10:50:01 root 26087 0.2 0.0 10604 5292 ? Ss 18:29 0:00 syslog-ng root 26087 0.1 0.0 10604 5292 ? Rs 18:29 0:00 syslog-ng root 26087 0.1 0.1 13988 8748 ? Ss 18:29 0:01 syslog-ng
This seems to be a lot indeed. Can you send us your configuration file to see what might be specific in your deployment? And could you also tell us the version of syslog-ng you are using? If this information is not enough to narrow down the problem I might need a core file of syslog-ng, but let's see the info first.
root 26087 0.1 0.1 17112 11804 ? Ss 18:29 0:02 syslog-ng Mon Sep 24 18:55:01 CST 2007 -- Bazsi
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
On Tue, 2007-09-25 at 14:41 +0800, liuruihong wrote:
In addition the syslog-ng receive logs from about 1000 clients when the usage of mem by syslog-ng keep growing I think maybe the reason of the problem is that there are so many log files being writted . I do another test ,using the same verson and the configure file,but receives logs from only one client,and usage of mem by syslog-ng doesn`t keep growing. But I don`t know the relationship between them.
Hm... what is your message rate? As I see syslog-ng kept growing to 500 MB of memory at a very fast pace (4-5MB/5 minutes) Does it reach a limit at 500 MB? Or the increase of memory usage continues? Or syslog-ng gets restarted? -- Bazsi
the increase of memory usage continues. -----邮件原件----- 发件人: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] 代表 Balazs Scheidler 发送时间: 2007年9月25日 15:07 收件人: Syslog-ng users' and developers' mailing list 主题: Re: [syslog-ng] 答复: 答复: 答复: why dose the usage of mem by syslog-ng keep growing? On Tue, 2007-09-25 at 14:41 +0800, liuruihong wrote:
In addition the syslog-ng receive logs from about 1000 clients when the usage of mem by syslog-ng keep growing I think maybe the reason of the problem is that there are so many log files being writted . I do another test ,using the same verson and the configure file,but receives logs from only one client,and usage of mem by syslog-ng doesn`t keep growing. But I don`t know the relationship between them.
Hm... what is your message rate? As I see syslog-ng kept growing to 500 MB of memory at a very fast pace (4-5MB/5 minutes) Does it reach a limit at 500 MB? Or the increase of memory usage continues? Or syslog-ng gets restarted? -- Bazsi _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
On Tue, 2007-09-25 at 15:13 +0800, liuruihong wrote:
the increase of memory usage continues.
Hmm... Something has just occurred to me. There was a bug report recently, which basically said, that once a write error occurs, syslog-ng does not correctly free memory, and all messages are buffered in memory. If you have about 1000 clients, you might well run out of fd's (the default limit for maximum file descriptors is around 1000), thus syslog-ng might not be able to open files. Do you have messages like this in your log? It should be "coming" from your internal() source. msg_error("Error opening file for writing", evt_tag_str("filename", self->filename->str), evt_tag_errno(EVT_TAG_OSERROR, errno), NULL); The workaround then would be to increase the maximum file handles (ulimit -n) before starting syslog-ng, the best is to put this in the init script.
-----邮件原件----- 发件人: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] 代表 Balazs Scheidler 发送时间: 2007年9月25日 15:07 收件人: Syslog-ng users' and developers' mailing list 主题: Re: [syslog-ng] 答复: 答复: 答复: why dose the usage of mem by syslog-ng keep growing?
On Tue, 2007-09-25 at 14:41 +0800, liuruihong wrote:
In addition the syslog-ng receive logs from about 1000 clients when the usage of mem by syslog-ng keep growing I think maybe the reason of the problem is that there are so many log files being writted . I do another test ,using the same verson and the configure file,but receives logs from only one client,and usage of mem by syslog-ng doesn`t keep growing. But I don`t know the relationship between them.
Hm... what is your message rate?
As I see syslog-ng kept growing to 500 MB of memory at a very fast pace (4-5MB/5 minutes) Does it reach a limit at 500 MB? Or the increase of memory usage continues? Or syslog-ng gets restarted?
-- Bazsi
On Tue, Sep 25, 2007 at 10:07:27AM +0200, Balazs Scheidler wrote:
The workaround then would be to increase the maximum file handles (ulimit -n) before starting syslog-ng, the best is to put this in the init script.
I just realized the FAQ doesn't mention ulimit anywhere. Fixed: http://www.campin.net/syslog-ng/faq.html#ulimit I've always had to do this on all my busy loghosts, should have gone into the performance section of the FAQ long ago. -- Nate "It could probably be shown by facts and figures that there is no distinctly native criminal class except Congress." - Samuel Clemens
I will use 'ulimit -n A 'to increase the maximum file handles, but is there a limit about the A ? -----邮件原件----- 发件人: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] 代表 Nate Campi 发送时间: 2007年9月26日 4:27 收件人: Syslog-ng users' and developers' mailing list 主题: [syslog-ng] WAS: why dose the usage of mem by syslog-ng keepgrowing? NOW: FAQ update On Tue, Sep 25, 2007 at 10:07:27AM +0200, Balazs Scheidler wrote:
The workaround then would be to increase the maximum file handles
(ulimit -n) before starting syslog-ng, the best is to put this in the
init script.
I just realized the FAQ doesn't mention ulimit anywhere. Fixed: http://www.campin.net/syslog-ng/faq.html#ulimit I've always had to do this on all my busy loghosts, should have gone into the performance section of the FAQ long ago. -- Nate "It could probably be shown by facts and figures that there is no distinctly native criminal class except Congress." - Samuel Clemens _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
I have resolved the problem by increasing the maximum file handle, Thanks all the person who helped me. _____ 发件人: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] 代表 liuruihong 发送时间: 2007年9月26日 11:22 收件人: 'Syslog-ng users' and developers' mailing list' 主题: [syslog-ng] 答复: WAS: why dose the usage of mem by syslog-ng keepgrowing? NOW: FAQ update I will use 'ulimit -n A 'to increase the maximum file handles, but is there a limit about the A ? -----邮件原件----- 发件人: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] 代表 Nate Campi 发送时间: 2007年9月26日 4:27 收件人: Syslog-ng users' and developers' mailing list 主题: [syslog-ng] WAS: why dose the usage of mem by syslog-ng keepgrowing? NOW: FAQ update On Tue, Sep 25, 2007 at 10:07:27AM +0200, Balazs Scheidler wrote:
The workaround then would be to increase the maximum file handles
(ulimit -n) before starting syslog-ng, the best is to put this in the
init script.
I just realized the FAQ doesn't mention ulimit anywhere. Fixed: http://www.campin.net/syslog-ng/faq.html#ulimit I've always had to do this on all my busy loghosts, should have gone into the performance section of the FAQ long ago. -- Nate "It could probably be shown by facts and figures that there is no distinctly native criminal class except Congress." - Samuel Clemens _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
This is a prime example of why file destinations (all destinations really) should follow the time_reap() and time_reopen() options. I just wanted to emphasize that I would like to see this on the to-do list. Is there a published "to-do list" or "wish list"? Evan. liuruihong wrote:
I have resolved the problem by increasing the maximum file handle,
Thanks all the person who helped me.
_____
发件人: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] 代表 liuruihong 发送时间: 2007年9月26日 11:22 收件人: 'Syslog-ng users' and developers' mailing list' 主题: [syslog-ng] 答复: WAS: why dose the usage of mem by syslog-ng keepgrowing? NOW: FAQ update
I will use 'ulimit -n A 'to increase the maximum file handles,
but is there a limit about the A ?
---------- syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] Nate Campi 2007年9月26日 4:27 Syslog-ng users' and developers' mailing list [syslog-ng] WAS: why dose the usage of mem by syslog-ng keepgrowing? NOW: FAQ update
On Tue, Sep 25, 2007 at 10:07:27AM +0200, Balazs Scheidler wrote:
The workaround then would be to increase the maximum file handles
(ulimit -n) before starting syslog-ng, the best is to put this in the
init script.
I just realized the FAQ doesn't mention ulimit anywhere. Fixed:
http://www.campin.net/syslog-ng/faq.html#ulimit
I've always had to do this on all my busy loghosts, should have gone
into the performance section of the FAQ long ago.
------------------------------------------------------------------------
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
-- Evan Rempel erempel@uvic.ca Senior Programmer Analyst 250.721.7691 Computing Services University of Victoria
On Wed, 2007-09-26 at 10:24 -0700, Evan Rempel wrote:
This is a prime example of why file destinations (all destinations really) should follow the time_reap() and time_reopen() options. I just wanted to emphasize that I would like to see this on the to-do list.
Is there a published "to-do list" or "wish list"?
We are working on installing a public bugzilla on our webserver. This is on my list, in fact I've started working on it already, but other things distracted me. -- Bazsi
participants (5)
-
Balazs Scheidler
-
Evan Rempel
-
Geller, Sandor (IT)
-
liuruihong
-
Nate Campi