[syslog-ng] Tests using loggen - not receiving all the packets

[Paul Robert Marino]

well if you are inserting into a database the database is your bottleneck
it looks like some of messages are being dropped by syslog-ng itself and 
some in the udp transit.
the majority being dropped by syslog-ng itself. you can increase the 
log_fifo_size to reduce the drops but it wont increase the database 
insert rate it will just give you a bigger buffer to handle traffic 
spikes. your best bet is to tune the database to get a faster insert 
rate. also disabling the atime on the file system should help.



On 3/31/2010 11:47 PM, Clayton Dukes wrote:
> Hi Folks,
> I'm trying to run a test to check insert rates.
> If I run this command:
>
> ./loggen -r 5000 -D -I 10 127.0.0.1 514
>
> The output shows:
> average rate = 5441.60 msg/sec, count=54420, time=10.007, msg 
> size=256, bandwidth=1360.40 kB/sec
>
> But, my stats don't show that many messages received:
>
> syslog-ng[6660]: Log statistics; dropped=\'pipe(/dev/xconsole)=0\', 
> processed=\'center(queued)=24232\', processed=\'center(received)=8077, 
> processed=\'destination(df_logzilla)=8077\'
>
> As you can see, it sent 55k messages, but I only received 8k.
> Am I doing something wrong?
>
> Here are my options in the syslog-ng config:
> options {
>       long_hostnames(off);
>       log_msg_size(8192);
>       flush_lines(1);
>       log_fifo_size(16384);
>       time_reopen(10);
>       use_dns(yes);
>       dns_cache(yes);
>       use_fqdn(yes);
>       keep_hostname(yes);
>       chain_hostnames(no);
>       perm(0644);
>      stats_freq(60);
>
> };
>
>
> -- 
> ______________________________________________________________
>
> Clayton Dukes
> ______________________________________________________________
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
>    

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20100401/9b2b3ea1/attachment.htm