[syslog-ng] Solaris 10 UDP overflows, message drops

[Matthew Hall]

On Fri, Apr 15, 2011 at 02:01:50PM -0400, Mishou Michael wrote:
> I left out the resources I have to work with on this system, and how
> bad/good things are with syslog-ng running (and dropping), I'll include
> those now.  As you can see, it's an older server, but it has a ton of
> RAM and the CPUs should have enough pop for this I think.

> I'm just not sure what to do next to troubleshoot.  I'm hoping someone
> here can point me in the right direction, or at least confirm that they
> are running syslog-ng in a similar configuration without drops so I know
> that it's at least possible?
> 
> Regards,
> 
> --Mike

I think the next suspect would be the disks. Can you disable anything that writes to disk or tell it to write to /dev/null and see if it still blows up?

Also, it's Solaris, so you could start using some of the dtrace scripts to look for what syscalls / other ops are running too slow, and when it gets stuck what type of socket / disk file / what IO is it doing?

Matthew.