[syslog-ng] Solaris 10 non-global zone & syslog-ngperformance question.
jim_surlow at csgsystems.com
Wed Mar 12 18:31:31 CET 2008
Thanks. I got this working.
A note to make:
http://www.syslog.org/syslog-ng/v2/ Tables 3.2 & 3.9 have the description & defaults switched half way through the table.
From: syslog-ng-bounces at lists.balabit.hu [mailto:syslog-ng-bounces at lists.balabit.hu] On Behalf Of Balazs Scheidler
Sent: Monday, March 10, 2008 5:44 AM
To: Syslog-ng users' and developers' mailing list
Subject: Re: [syslog-ng] Solaris 10 non-global zone & syslog-ngperformance question.
On Thu, 2008-03-06 at 18:35 -0700, Surlow, Jim wrote:
> I’m a newbie to syslog-ng. Everything is working in my environment,
> running 2.0.8. But, when I try to stress the server I drop messages.
> I’m running from another physical server:
> ./loggen -D -s 111 -r 2000 -I 1 <hostname> 514 ; date
> average rate = 1818.00 msg/sec, count=1818
> Thu Mar 6 18:07:17 MST 2008
> Since I can see all the messages with standard syslog in this Sol 10
> non-global zone, I’ve ruled out:
> · the zone being an issue.
> · UDP tuning for the Solaris 10 host.
> · The internal hard drive i/o speed from being an issue.
> Looking at the log messages, I’m not hitting some cap (e.g. 1233) and
> then not logging any more. Random gaps (both of frequency and size)
> are seen throughout.
Still, you should increase your UDP receive buffer. Syslog-ng has more
latency wrt reading the socket buffer, so that's why you can see more
drops. This is not a throughput issue in itself if you have large enough
buffers (e.g. the message rate might be higher than syslogd, but the
latency between message receival might be long enough to overflow your
UDP receive buffers).
So so_rcvbuf() is the option you need. Be sure that you also check what
the default OS limit is.
syslog-ng maillist - syslog-ng at lists.balabit.hu
Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
More information about the syslog-ng