[syslog-ng] Leaking objects in size-4096 cache in slabinfo

[Balazs Scheidler]

On Fri, 2009-12-18 at 13:30 -0500, Doug Warner wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On 12/18/2009 11:41 AM, Balazs Scheidler wrote:
> >> > I guess the big concern here is why our recv-q is so high and what we can do
> >> > to reduce it.
> >> > 
> >> > These are the current global options (nothing set on the src or dest since
> >> > this syslog server only handles the tcp connections):
> >> > 
> >> > options {
> >> >         chain_hostnames(off);
> >> >         dns_cache(yes);
> >> >         log_fifo_size(5000);
> >> >         flush_lines(200);
> >> >         flush_timeout(1000);
> >> >         use_fqdn(yes);
> >> >         stats_freq(300);
> >> > };
> >> > 
> >> > Most destinations are files but we do have one program.  The box doesn't seem
> >> > to be particularly loaded otherwise.
> >> > 
> >> > Do these values seem like we're trying to make syslog-ng cache too much
> >> > information?  Is there other settings we should tweak to try to get the
> >> > messages through syslog-ng faster?
> > Do you have flow control enabled on any of your log paths? is syslog-ng
> > burning your CPU, is it CPU bound?
> 
> Periodically when syslog-ng seems to be working fine we'll see syslog-ng using
> a bit of CPU (~20%), but more commonly right now we see it using very little
> and the recv-q building up.
> 
> Non of our src/dest in syslog-ng have any flags set other than the above
> global options; so whatever is the default for 3.0.4 OSE should be what we're
> using.

Strange. Can you start strace on the syslog-ng process, preferably with
timestamps (-ttT -s 256 -p <pid>) options to see what it is doing?


-- 
Bazsi