[syslog-ng] syslog-ng[3933]: STATS: dropped 1074

[Sandor Geller]

ashish tyagi wrote:
> hi all
>            I am using syslog-ng and php-syslog-ng with mysql to store
> logs on fedora core 4. i installed it using RPM for fedora 4. it is
> being used as a central loging server.in /var/log/messages a message
> appeares regularly "syslog-ng[3933]: STATS: dropped 1027".what does
> this message means, is it dropping messages comming from other
> servers.if i have done something wrong. i have attached syslog-ng
> configuration file.

This message means that you have one or more slow destinations which
can't handle the traffic.

Generally slow destinations are the terminals (console, usertty) and in
your case the mysql pipe can be a bottleneck too. If you can test change
the pipe temporary into a file destination and see whether the number of
dropped messages changes significantly or not.

Unfortunately syslog-ng 1.6.x aggregates the dropped messages, while
1.9.x can output statistics by destinations so with 1.9.x it is much
easier to find the bottleneck.

-- 
Sandor Geller
wildy at balabit.hu