[syslog-ng] Message loss: update 1

[Vincent Haverlant]

Hello Guys,

Here's an update on my investigation (still using latest 1.9.9 snapshot on Solaris 8):
- I have proof (snoop/tcpdump) that all sent packets indeed arrive at the
  network interface of my syslog server

- I have validated, using a simple while { recvfrom; printf } loop that all udp
  packets CAN go through the network layer with the default system buffer
  settings without any packet loss.

- By adding a debugging mesage right after the recvfrom call in
  syslog-ng (in fd_do_read), I can validate that no message that is
  received that way is lost within syslog-ng. However I still observe a
  loss of messages.

- I do not see a significant increase in udpInOverflows during the
  tests. Even though through the day, this value may increase of a few
  units.

Default buffer settings are:
ndd /dev/udp udp_recv_hiwat
65536
ndd /dev/udp udp_max_buf   
1048576

Meaning that the default socket buffer size is 64k. IT CANNOT BE
INCREASED FURTHER UP. I thus decided to the following code:
----
int rcvbuflen=1048576;
setsockopt(sock, SOL_SOCKET, SO_RCVBUF, &rcvbuflen, sizeof(rcvbuflen));
----
in g_sockaddr_inet_bind_prepare which apparently solved my problem or at
least allowed my test to pass. 
This does not guarantee that when the traffic increases further up for
any reason, I will not jump once again to the limit of the socket
buffer.

I still have one problem though: why didn't the packet show up in
udpInOverflow when they should have ? I'll keep you updated when I find
out. Also I'll try to provide a patch for the setsockop stuff but not
being a good developper it might be better if one of you official
syslog-ng team member took it from here.

Keep up the good work...
Vincent.
-- 
   .~.     Vincent Haverlant  -- Galadril -- #ICQ: 35695155   
   /V\      MSN: vincent_msn at haverlant.org  -- http://www.haverlant.org/
  /( )\      Parinux member: http://www.parinux.org/
  ^^-^^       GPG: 8FEA 52C2 5C54 A201 2375  0FA5 AF2E 1881 92D0 EE84