[syslog-ng] max-connections

[Balazs Scheidler]

On Tue, 2006-12-19 at 16:59 -0800, Nate Campi wrote:
> On Mon, Dec 18, 2006 at 07:24:47PM +0100, Balazs Scheidler wrote:
> > On Mon, 2006-12-18 at 15:23 +0000, Hari Sekhon wrote:
> > > I've got a central logserver on syslog-ng and am getting the following 
> > > in my logs:
> > > 
> > > syslog-ng[26180]: Error accepting AF_UNIX connection, opened 
> > > connections: 100, max: 100
> > > 
> > 
> > AF_UNIX refers to unix domain sockets, e.g. you are probably hitting the
> > maximum on unix-stream("/dev/log");
> 
> Yup, either change it to:
> 
>  unix-dgram("/dev/log");
> 
> ...or:
> 
>  unix-stream("/dev/log" max-connections(200));
> 
> I see problems with /dev/log connections piling up when boxes are under
> high load, like 30+. When syslog-ng doesn't get enough CPU time to deal
> with incoming logs, you either have to move to unix-dgram and accept the
> possibility of message loss, or keep increasing the /dev/log connection
> limit and hope your boxes eventually catch up. :(

Or you could try playing with process priorities.

-- 
Bazsi