[syslog-ng]Losing 25% of messages using UDP

[Gregor Binder]

Bill Graham on Fri, Apr 11, 2003 at 02:19:48PM -0700:

Hi Bill,

> I guess I should have included the rest of my configuration...

you're right, this sounds like one happy syslog server :)

> It just seems that 
> the program can't keep up when the udp buffer is set to the default of 
> 8K.  Once you bring this number to the system max of 64K the system can 
> handle bursts of around 750 syslog messages.

Do you see message loss with higher rates again? Increasing sockbuf
certainly does make sense, but it still wouldn't explain why a userland-
program can't keep up if your system resources are not exhausted.

You could maybe try to avoid interrupts/context switches by using async
disk access, and see if that improves performance. Binding syslog-ng to
one CPU is probably not reasonable, since you plan to deploy other
applications. Then obviously, you will have to expect performance to
drop again, if hardware (unlikely, I admit) or kernel resources are the
real limitation you're looking at.

Regards,

-- 
 ____ ____ 
/  _/| -  >  Gregor Binder <gb@(rootnexus.net|sysfive.com)>
| / || _\ \
\__ Id: 0xE2F31C4B Fp: 8B8A 5CE3 B79B FBF1 5518 8871 0EFB AFA3 E2F3 1C4B