[syslog-ng] STATS: dropped with version 1.6.8 under rh el4

Ken Garland ken.garland at rotech.com
Wed Aug 10 15:48:59 CEST 2005


Yes, receiving those lines are annoying and I drop this line into the 
client syslog-ng.conf:

filter f_syslog { not facility(auth, authpriv, kern) and 
                  not match("STATS: dropped 0"); };


Then just use that filter in your log line.

- Ken

Stephan Hendl wrote:

>Hi all,
>
>recently I upgraded one of my central syslog servers from hpux to redhat el4 with syslog-ng-1.6.8-1 and get from time to time messages like
>
>Aug 10 11:43:57 pns1 syslog-ng[10542]: STATS: dropped 19
>Aug 10 11:48:57 pns1 syslog-ng[10542]: STATS: dropped 45
>Aug 10 11:53:57 pns1 syslog-ng[10542]: STATS: dropped 0
>Aug 10 11:58:57 pns1 syslog-ng[10542]: STATS: dropped 36
>Aug 10 12:03:57 pns1 syslog-ng[10542]: STATS: dropped 7
>Aug 10 12:08:57 pns1 syslog-ng[10542]: STATS: dropped 0
>Aug 10 12:13:57 pns1 syslog-ng[10542]: STATS: dropped 0
>Aug 10 12:18:57 pns1 syslog-ng[10542]: STATS: dropped 0
>Aug 10 12:23:57 pns1 syslog-ng[10542]: STATS: dropped 0
>Aug 10 12:28:57 pns1 syslog-ng[10542]: STATS: dropped 0
>Aug 10 12:33:57 pns1 syslog-ng[10542]: STATS: dropped 0
>Aug 10 12:38:57 pns1 syslog-ng[10542]: STATS: dropped 0
>Aug 10 12:43:57 pns1 syslog-ng[10542]: STATS: dropped 0
>Aug 10 12:48:57 pns1 syslog-ng[10542]: STATS: dropped 37
>Aug 10 12:53:57 pns1 syslog-ng[10542]: STATS: dropped 52
>Aug 10 12:58:57 pns1 syslog-ng[10542]: STATS: dropped 0
>Aug 10 13:03:57 pns1 syslog-ng[10542]: STATS: dropped 0
>Aug 10 13:08:57 pns1 syslog-ng[10542]: STATS: dropped 51
>Aug 10 13:13:57 pns1 syslog-ng[10542]: STATS: dropped 0
>Aug 10 13:18:57 pns1 syslog-ng[10542]: STATS: dropped 0
>Aug 10 13:23:57 pns1 syslog-ng[10542]: STATS: dropped 11
>Aug 10 13:28:57 pns1 syslog-ng[10542]: STATS: dropped 1
>Aug 10 13:33:57 pns1 syslog-ng[10542]: STATS: dropped 0
>Aug 10 13:38:57 pns1 syslog-ng[10542]: STATS: dropped 0
>
>There are 5 servers who are sending their syslog messages via tcp an one 2 servers who are sending via udp to that central server. The load of the machine (2xXenon CPU, 3 GHz, 1 GB RAM) is really low. For revison purposes (maillogdata) I have to keep _all_ syslog lines!!! What can I change in order to avoid dropped lines?
>
>Stephan
>
>top - 15:39:06 up 36 days,  1:49,  2 users,  load average: 0.10, 0.09, 0.04
>Tasks: 194 total,   1 running, 193 sleeping,   0 stopped,   0 zombie
>Cpu(s):  0.3% us,  0.2% sy,  0.0% ni, 99.2% id,  0.4% wa,  0.0% hi,  0.0% si
>Mem:   1034692k total,  1018520k used,    16172k free,   141372k buffers
>Swap:  2096440k total,      144k used,  2096296k free,   602228k cached
>
>  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND
>  690 root      16   0 43644 4784 2180 S  0.7  0.5 129:42.96 nco_p_syslog
>  779 root      16   0 43644 4784 2180 S  0.3  0.5 254:33.32 nco_p_syslog
>10542 root      15   0  1876 1048  776 S  0.3  0.1   6:59.31 syslog-ng
>    1 root      16   0  3236  548  472 S  0.0  0.1   0:00.96 init
>    2 root      RT   0     0    0    0 S  0.0  0.0   0:04.37 migration/0
>    3 root      34  19     0    0    0 S  0.0  0.0   0:00.06 ksoftirqd/0
>    4 root      RT   0     0    0    0 S  0.0  0.0   0:03.11 migration/1
>    5 root      34  19     0    0    0 S  0.0  0.0   0:00.02 ksoftirqd/1
>
>My syslog-ng.conf looks like:
>
>root at pns1:~# vi /etc/syslog-ng/syslog-ng.conf
># syslog-ng configuration file.
>#
># This should behave pretty much like the original syslog on RedHat Linux 9.
># But it could be configured a lot smarter.
>#
># See syslog-ng(8) and syslog-ng.conf(5) for more information.
>
>options {sync (0);
>         time_reopen (10);
>         long_hostnames (off);
>         use_dns (yes);
>         use_fqdn (no);
>         create_dirs (no);
>         keep_hostname (yes);
>         stats (300);
>};
>
>source s_sys { pipe ("/proc/kmsg" log_prefix("kernel: ")); unix-stream ("/dev/log"); internal(); };
>source s_tcp { tcp(ip(a.b.c.d) port(10514) keep-alive(no)); };
>source s_udp { udp(ip(a.b.c.d) port(514)); };
>
># Log all kernel messages to the console.
># Logging much else clutters up the screen.
>#destination    d_cons  { file("/dev/console"); };
>#filter         f_cons  { facility(kern); };
>#log { source(s_sys); filter(f_cons); destination(d_cons); };
>
># Log anything (except mail) of level info or higher.
># Don't log private authentication messages!
>destination     d_mesg  { file("/var/log/messages"); };
>filter          f_mesg  { not facility(mail,news,authpriv,cron) and level(emerg..info); };
>log { source(s_sys); filter(f_mesg); destination(d_mesg); };
>
># The authpriv file has restricted access.
>destination     d_auth  { file("/var/log/secure"); };
>filter          f_auth  { facility(authpriv); };
>log { source(s_sys); filter(f_auth); destination(d_auth); };
>
># Log all the mail messages in one place.
>destination     d_mail  { file("/var/log/maillog" template( "$DATE $HOST $MESSAGE\n")); };
>filter          f_mail  { facility(mail); };
>log { source(s_sys); filter(f_mail); destination(d_mail); };
>
># Log cron stuff.
>destination     d_cron  { file("/var/log/cron"); };
>filter          f_cron  { facility(cron); };
>log { source(s_sys); filter(f_cron); destination(d_cron); };
>
># Everybody gets emergency messages.
>destination     d_mlal  { usertty("*"); };
>filter          f_mlal  { level(emerg); };
>log { source(s_sys); filter(f_mlal); destination(d_mlal); };
>
># Save news errors of level crit and higher in a special file.
>destination     d_spol  { file("/var/log/spooler"); };
>filter          f_spol  {facility(uucp) or facility(news) and level(emerg..crit); };
>log { source(s_sys); filter(f_spol); destination(d_spol); };
>
># Save boot messages also to boot.log.
>destination     d_boot  { file("/var/log/boot.log"); };
>filter          f_boot  { facility(local7); };
>log { source(s_sys); filter(f_boot); destination(d_boot); };
>
># Save all mesages to syslog.lvnbb.de
>destination     d_tcp   { tcp("localhost" port(10514)); };
>log { source(s_sys); destination(d_tcp); };
>log { source(s_tcp); destination(d_tcp); };
>log { source(s_udp); destination(d_tcp); };
>
># Save all messages to pipe /tmp/cic.pipe
>destination     d_cic   { pipe("/tmp/cic.pipe" owner("root") group("root") perm(0640) template("$DATE $HOST $MESSAGE\n") template-escape(yes)); };
>log { source(s_sys); destination(d_cic); };
>log { source(s_tcp); destination(d_cic); };
>log { source(s_udp); destination(d_cic); };
>
>_______________________________________________
>syslog-ng maillist  -  syslog-ng at lists.balabit.hu
>https://lists.balabit.hu/mailman/listinfo/syslog-ng
>Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
>
>  
>



More information about the syslog-ng mailing list