Antw: Re: [syslog-ng] STATS: dropped with version 1.6.8 underrh el4

[Stephan Hendl]

The host 'pns1' is a - let's say a syslog repeater. It gets messages from 5 hosts via tcp (two of these five are mailservers and send the maiilog via syslog-ng) and from 2 hosts as well as an internet router/firewall via udp. The syslog-ng writes the lines into files as well as into a pipe where a third program read the lines and evaluates they according to given patterns. Additionally the syslog-ng sends all messages through a ssh tunnel to another syslog-ng. This is the whole situation.Aafter including the "log_fifo_size (128056);" parameter there were no dropped lines anymore.

Stephan


>>> ken.garland at rotech.com 11.08.2005 14:52:34 >>>
Mike Tremaine wrote:

>On Wed, 2005-08-10 at 07:21, Stephan Hendl wrote:
>  
>
>>the lines with values "STATS: dropped <!=0>" are very annoying. How
>>can I prevent the syslog-ng from dropping lines??? I put the line
>>"log_fifo_size(1000);" into the global section - hope that helps ;-)))
>>
>>    
>>
>
>If the hosts only job is syslog-ng go for broke and kick it up to
>something higher then 1000.
>
>log_fifo_size (128056);
>
>[I used that when I was doing some testing with an old AMD-k62 500mhz
>256MB and FC3, it ran with 5 hosts sending as fast as the could to it.
>Didn't drop anything.]
> 
>
>  
>
I have about 15 systems logging to my syslog-ng server and some of them 
are routers which send a ton of messages about up/down link state. This 
server is getting smashed with logs and I have not received any dropped 
messages other than the 'DROPPED 0' which is a good thing that the 
syslog-ng host is saying it has not dropped any log packets. I would 
think something else is going on here and the fifo would not need to be 
increased as my fifo setting is only at 1024.

In your first message you pasted something from the host 'pns1' which 
was complaining about dropping multiple packets. What is this system and 
is it running syslog-ng, also what connection is it using? tcp/udp? Are 
there other hosts which are sending out dropped log messages or only pns1?

- Ken
_______________________________________________
syslog-ng maillist  -  syslog-ng at lists.balabit.hu 
https://lists.balabit.hu/mailman/listinfo/syslog-ng 
Frequently asked questions at http://www.campin.net/syslog-ng/faq.html