[syslog-ng] Assessing reliability - did we get all messages?
Kim.Cary at pepperdine.edu
Wed Jun 1 19:02:20 CEST 2005
I'm trying to figure out whether we're getting all messages from a PIX
into the mysql database. I've done some tests and everything syslog-ng
is writing to disk is going to our db on the application server. Now I
need to figure out if syslog-ng is getting everything (or nearly) from
Specifically my questions are:
- Does 'garbage collecting while busy' imply I'm dropping packets?
- Any suggestions for checking my UDP buffers on the syslog server?
- I'd like to use TCP from the PIX > syslog-ng. Does that work?
Its a little hard to test as this is a production system on our
internet gateway. My understanding is that Pix logging via TCP will
STOP the transmission of packets if the syslog server goes away, so, we
may not want to do that with a single syslog server.
Our setup is like this:
Application server (mysql log database & web-based search interface -
MacOS X Panther)
^ TCP ^
Syslog server (perl script (fisq.pl) parses input and sends via perl
Syslog server (syslog-ng 1.6.4 from sunfreeware, Solaris 9 1.5G ) >
file on local disk
The network run for the PIX > Syslog server link is dedicated 100Mbps
We get about 20Gb of syslog messages a day from that source.
Here's what syslog-ng says about itself:
May 31 22:27:11 logsrvr syslog-ng: STATS: dropped 0
May 31 22:37:11 logsrvr syslog-ng: STATS: dropped 0
May 31 22:45:14 logsrvr syslog-ng: Garbage collecting while busy...
May 31 22:45:17 logsrvr syslog-ng: Objects alive: 240, garbage
May 31 22:47:11 logsrvr syslog-ng: STATS: dropped 0
May 31 22:57:11 logsrvr syslog-ng: STATS: dropped 0
May 31 23:04:21 logsrvr syslog-ng: Garbage collecting while idle...
May 31 23:04:22 logsrvr syslog-ng: Objects alive: 240, garbage
May 31 23:07:11 logsrvr syslog-ng: STATS: dropped 0
May 31 23:17:11 logsrvr syslog-ng: STATS: dropped 0
Here are our tuning options from syslog-ng.conf:
BTW, syslog-ng is 'the bomb'. I love what we can do with it more easily
than stock syslog.
More information about the syslog-ng