[syslog-ng] Solaris syslog-ng tuning

[Balazs Scheidler]

On Thu, 2006-03-16 at 20:24 -0800, Cary, Kim wrote:
> In summary, tuning the solaris udp hiwat and max_buf had no effect on  
> the continuous udpInOverflows loss.
> 
> At present, changing some parameters in syslog-ng.conf has helped, it  
> seems.
> 
> We have now gone from
> 
>            log_fifo_size(100000);
>            gc_busy_threshold(3000000);
>            gc_idle_threshold(300);
> 
> and having
> 
> A1) udpInOverFlows increment by 3000 every 4 sec
> A2) Garbage collecting while busy for 3 sec every half hour at peak
> 
> to
> 
>            log_fifo_size(1000000); # up an order of magnitude
>            gc_busy_threshold(300000); # down an order of magnitude
>            gc_idle_threshold(500); # log was reporting objects  
> 310-322 range, so some headroom
> 
> and having
> 
> B1) udpInOverflows increment by  50 every half hour
> B2) Garbage collecting while busy for a fraction of a second every  
> 4-8 minutes
> 
> This seems better. Hope that helps someone out there.
> 
> My first question - we are losing messages during GC while busy - do  
> we only lose the messages that arrive between these two log entries:
> 
> Mar 16 20:00:30  syslog-ng[9688]: Garbage collecting while busy...
> Mar 16 20:00:31  syslog-ng[9688]: Objects alive: 310, garbage  
> collected: 299695
> 
>   My second question is, what can we do better to tune this further?
> 
> Thanks to all (& Balasz for the wonderful software).

IIRC someone pointed out that the receive buffer cannot forcedly be
increased on Solaris outside the application, so syslog-ng should call
SO_RCVBUF setsockopt which it does not at the moment. You could
hand-patch a hard-coded number though.

-- 
Bazsi