[syslog-ng] Syslog-ng dropped packets.

[Vaibhav Goel]

We are using 1.6.5 (soon to upgrade to 1.6.11) in a production
environment.  Is 1.9.11 production ready?  I recall a message from you
saying that you are looking to release 2.0.0 within a month.  I will
install 1.9.11 on my QA server and start testing it once we deploy
1.6.11 to prod.  I am actually not using /dev/xconsole... I have 2
production loghosts and one of them is more heavily used then the other.
I am seeing dropped packets on that one during peak hours.  That leads
me to believe that syslog-ng.  Is there a way to increase the incoming
buffer in another way?

-----Original Message-----
From: syslog-ng-bounces at lists.balabit.hu
[mailto:syslog-ng-bounces at lists.balabit.hu] On Behalf Of Balazs
Scheidler
Sent: May 25, 2006 3:51 AM
To: Syslog-ng users' and developers' mailing list
Subject: Re: [syslog-ng] Syslog-ng dropped packets.

On Wed, 2006-05-24 at 16:35 -0700, Vaibhav Goel wrote:
> Recently, I started seeing dropped packets in syslog-ng.  I increased
> the log_fifo_size to 2000 (it was 1000) and it abated the problem
> somewhat.  But I am still seeing some dropped packets.  Could I
> increase the log_fifo_size?  Are there any other tips?  Unfortunately,
> we are going to be adding more logging load to this loghost and I am
> worried that this problem might increase.  Any ideas?

The most important part in addressing this problem is finding out which
destination drops packets. syslog-ng 1.6.x only gave a global counter.

You might have a slow destination (like /dev/xconsole) whereas your
normal log flow works fine.

If your primary log output is slow, you could switch to 1.9.11 which
includes log message flow control.

-- 
Bazsi

_______________________________________________
syslog-ng maillist  -  syslog-ng at lists.balabit.hu
https://lists.balabit.hu/mailman/listinfo/syslog-ng
Frequently asked questions at http://www.campin.net/syslog-ng/faq.html