[syslog-ng] Message loss (probably) within syslog-ng

[Vincent Haverlant]

Hi Mike, 

Le Sun Mar  5 15:12:11 2006, Mike a écrit:
| 
| 
| On Sun, 5 Mar 2006, Vincent Haverlant wrote:
| 
| >Hi,
| >
| >I get a kind of message loss trouble like in some previous message with the subject "remote logging not reliable", but in his case, the remote 
| >logging was done other tcp and this was pointed as the probable cause of message loss. In my case only udp is involved.
| >
| 
| is your OS dropping packets before syslog-ng gets a chance to grab them?

Definitely no or at least not in any visible way: 
- no drop in netstat -s for either UDP nort IPv4
- if I snoop at the same time on the receiving interface, I get the
  right number of packets.

| if you see some, then you can increase your UDP buffer size to help smooth this out in the case of bursts.

I'd love to do that anyway but in fact this is only doable by a setsockopt
syscall (SO_RCVBUF) and there's not option in the config file to do it.
I'll try to do it but I'm not sure the cause is here.

Vincent.
-- 
   .~.     Vincent Haverlant  -- Galadril -- #ICQ: 35695155   
   /V\      MSN: vincent_msn at haverlant.org  -- http://www.haverlant.org/
  /( )\      Parinux member: http://www.parinux.org/
  ^^-^^       GPG: 8FEA 52C2 5C54 A201 2375  0FA5 AF2E 1881 92D0 EE84