[syslog-ng]Dropped messages and UDP buffer sizes

Clemson, Chris syslog-ng@lists.balabit.hu
Fri, 11 Jul 2003 09:14:44 +0100

> On Thu, Jul 10, 2003 at 09:39:18AM +0100, Clemson, Chris wrote:
> > Hello!
> > We are trying to use syslog-ng to log messages from several servers.
> > We get quite a few "dropped" messages from syslog-ng saying 
> between 70 and
> > 290 are being dropped each time.
> > According to the list, it sounds like we need to increase 
> out UDP receive
> > buffer size.
> If syslog-ng reports dropped messages in itself, increasing 
> UDP receive
> buffer will not help, as syslog-ng itself has already pulled 
> the message.

ah, i see.

> Message drops within syslog-ng might happen because one or more of the
> destinations process messages slower than the sources. If you 
> only have file
> destinations then increasing log_fifo_size() might help.

it seems, after a bit more fiddling around, that it is a problem when
logging to mysql (i didn't realise we were still logging to it).
when we stop logging to mysql, 0 lines are dropped.
is there anything we can do to buffer logging to mysql?



The content of this e-mail is confidential, may contain privileged material
and is intended solely for the recipient(s) named above. If you receive this
in error, please notify Software AG immediately and delete this e-mail.

Software AG (UK) Limited
Registered in England & Wales 1310740
Registered Office: Hudson House, Hudson Way,
Pride Park, Derby DE24 8HS