[syslog-ng] Solaris 10 non-global zone & syslog-ng performance question.

[Balazs Scheidler]

On Thu, 2008-03-06 at 18:35 -0700, Surlow, Jim wrote:
> Folks,
> 
>  
> 
> I’m a newbie to syslog-ng.  Everything is working in my environment,
> running 2.0.8.  But, when I try to stress the server I drop messages.
> 
>  
> 
> I’m running from another physical server:
> 
> ./loggen -D -s 111 -r 2000 -I 1 <hostname> 514 ; date
> 
> average rate = 1818.00 msg/sec, count=1818
> 
> Thu Mar  6 18:07:17 MST 2008
>  
> 
> Since I can see all the messages with standard syslog in this Sol 10
> non-global zone, I’ve ruled out:
> 
> ·       the zone being an issue.
> 
> ·       UDP tuning for the Solaris 10 host.
> 
> ·       The internal hard drive i/o speed from being an issue.
> 
>  
> 
> Looking at the log messages, I’m not hitting some cap (e.g. 1233) and
> then not logging any more.  Random gaps (both of frequency and size)
> are seen throughout.

Still, you should increase your UDP receive buffer. Syslog-ng has more
latency wrt reading the socket buffer, so that's why you can see more
drops. This is not a throughput issue in itself if you have large enough
buffers (e.g. the message rate might be higher than syslogd, but the
latency between message receival might be long enough to overflow your
UDP receive buffers).

So so_rcvbuf() is the option you need. Be sure that you also check what
the default OS limit is.

-- 
Bazsi