[syslog-ng]STATS: dropped 74625 and very high Load

[Balazs Scheidler]

On Thu, 2004-10-28 at 14:50, Stefan Schluppeck wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Hello,
> 
> I have running a central syslog-ng under SLES9 (SuSE Linux Enterprice
> Server).
> 
> ca. 90 Servers and 150 Network copunents are logging to this server
> 
> I have some times "STATS: dropped 74625" and i have high load round
> about 11.
> 
> What can i do, that no loglines are lost and the load is not so high?
> 
> My global config:
> options         {
> ~                long_hostnames(off);
> ~                sync(1024);
> ~                log_fifo_size(300000);
> ~                gc_busy_threshold(1000);
> ~                gc_idle_threshold(30000);
> ~                };
> 

Are you sure it is syslog-ng which generates the load? (because by
definition syslog-ng on its own can generate at most a load of 1) 

The STATS counter is incremented every time syslog-ng would have
something to write but the receiving side does not accept messages.
Probably you have a program/pipe/tcp destination not accepting messages
in a timely manner.

Other tuning possibilities (though it affects receiving, not sending) is
to to disable DNS resolution and/or increase the UDP receive buffers.

-- 
Bazsi