[syslog-ng]Syslog Logging Delay

[Brian E. Seppanen]

Here it stops again at approx 10:44 a.m. EST.

Again UDP:514 is 65550.  Packets are still coming.  No logging.  Tried
logging via logger and no messages.

10:53 a.m. EST it starts again.  vmstat doesn't indicate much disk
activity blocking either in or out either before or after.  After it picks
up again the messages I logged via logger are logged.

Utilization on the box is pretty steady.  Swap neither grows, nor
diminishes.  Memory is used for the most part, maybe about 10MB free.
Lots of shared memory.

Graphs show loopback at 10:45 is quite active comparitively.
This is from a dump of an rrdtool database monitoring loopback
utilization.  This doesn't correlate to other times when I've seen the
problem though, specifically when it stopped logging at 10:10 p.m. EST.
Normall readings for the graph are around 2.e+01.
<!-- 2001-03-29 10:40:00 EST --> <row><v> 2.8297444075e+01 </v><v> 2.8297444075e+01 </v></row>
<!-- 2001-03-29 10:45:00 EST --> <row><v> 5.7677917503e+01 </v><v> 5.7677917503e+01 </v></row>
<!-- 2001-03-29 10:50:00 EST --> <row><v> 9.0888004719e+01 </v><v> 9.0888004719e+01 </v></row>


POLLIN}, {fd=7, events=0}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN},
{fd=4, events=POLLIN}, {fd=3, events=POLLIN}], 17, 100) = 0
poll([{fd=12, events=0}, {fd=11, events=0}, {fd=21, events=0}, {fd=10,
events=0}, {fd=22, events=POLLIN}, {fd=14, events=0}, {fd=13,
events=POLLIN}, {fd=17, events=0}, {fd=16, events=POLLIN}, {fd=15,
events=0}, {fd=9, events=0}, {fd=8, events=POLLIN}, {fd=7, events=0},
{fd=6, events=POLLIN}, {fd=5, events=POLLIN, revents=POLLIN}, {fd=4,
events=POLLIN}, {fd=3, events=POLLIN}], 17, 6000) = 1
recvfrom(5, "<133>559901: 4w3d: %UBR7200-5-MA"..., 1024, 0,
{sin_family=AF_INET, sin_port=htons(49364),
sin_addr=inet_addr("24.247.48.35")}}, [16]) = 163
time(NULL)                              = 985880402
time(NULL)                              = 985880402
time(NULL)                              = 985880402
time(NULL)                              = 985880402
poll([{fd=12, events=0}, {fd=11, events=0}, {fd=21, events=0}, {fd=10,
events=0}, {fd=22, events=POLLIN}, {fd=14, events=0}, {fd=13,
events=POLLIN}, {fd=17, events=0}, {fd=16, events=POLLIN}, {fd=15,
events=0}, {fd=9, events=0}, {fd=8, events=POLLIN}, {fd=7, events=POLLOUT,
revents=POLLOUT}, {fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=4,
events=POLLIN}, {fd=3, events=POLLIN}], 17, 100) = 1
write(7, "Mar 29 10:40:02 24.247.48.35 559"..., 188) = 188
time(NULL)                              = 985880402
poll([{fd=12, events=0}, {fd=11, events=0}, {fd=21, events=0}, {fd=10,
events=0}, {fd=22, events=POLLIN}, {fd=14, events=0}, {fd=13,
events=POLLIN}, {fd=17, events=0}, {fd=16, events=POLLIN}, {fd=15,
events=0}, {fd=9, events=0}, {fd=8, events=POLLIN}, {fd=7, events=0},
{fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=4, events=POLLIN},
{fd=3, events=POLLIN}], 17, 100) = 0
poll([{fd=12, events=0}, {fd=11, events=0}, {fd=21, events=0}, {fd=10,
events=0}, {fd=22, events=POLLIN}, {fd=14, events=0}, {fd=13,
events=POLLIN}, {fd=17, events=0}, {fd=16, events=POLLIN}, {fd=15,
events=0}, {fd=9, events=0}, {fd=8, events=POLLIN}, {fd=7, events=0},
{fd=6, events=POLLIN}, {fd=5, events=POLLIN}, {fd=4, events=POLLIN},
{fd=3, events=POLLIN, revents=POLLIN}], 17, 4000) = 1
read(3,

I don't know.  Nothing to correlate it to stopping at 10:10:00 p.m. EST
last night though...

I'm just not seeing anything that sticks out to indicate where a problem
might be.

Can someone who is running a central logging server indicate how they have
configured syslog-ng, as far as log_fifo_size, garbage collection options,
number of objects alive at any one time after running for a while, sync
options?  I would appreciate it, greatly.

Thanks,


Brian Seppanen
Charter Communications
Regional Data Center				906-228-4226 ext 23
Marquette, MI					seppy@chartermi.net