[syslog-ng] Solaris syslog-ng tuning

[Cary, Kim]

In summary, tuning the solaris udp hiwat and max_buf had no effect on  
the continuous udpInOverflows loss.

At present, changing some parameters in syslog-ng.conf has helped, it  
seems.

We have now gone from

           log_fifo_size(100000);
           gc_busy_threshold(3000000);
           gc_idle_threshold(300);

and having

A1) udpInOverFlows increment by 3000 every 4 sec
A2) Garbage collecting while busy for 3 sec every half hour at peak

to

           log_fifo_size(1000000); # up an order of magnitude
           gc_busy_threshold(300000); # down an order of magnitude
           gc_idle_threshold(500); # log was reporting objects  
310-322 range, so some headroom

and having

B1) udpInOverflows increment by  50 every half hour
B2) Garbage collecting while busy for a fraction of a second every  
4-8 minutes

This seems better. Hope that helps someone out there.

My first question - we are losing messages during GC while busy - do  
we only lose the messages that arrive between these two log entries:

Mar 16 20:00:30  syslog-ng[9688]: Garbage collecting while busy...
Mar 16 20:00:31  syslog-ng[9688]: Objects alive: 310, garbage  
collected: 299695

  My second question is, what can we do better to tune this further?

Thanks to all (& Balasz for the wonderful software).