[syslog-ng] Solaris 10 UDP overflows, message drops

[Fred Connolly]

I am experiencing the same problem with Sun V490 except the server has about
16gb memory. We are using UDP and losing about 85% of the traffic.  The
udpinoverflows is darn near equal to the total number of packets coming in.
I am not at work now so cannot provide accurate statistics at this time. The
NIC statistics are perfect, we aren't getting any errors with regards to the
UDP area etc.

There is a kernel patch that came out about a week or two ago that deals in
this area, but I have not yet applied it. I want to apply the patch first
before adjusting other kernel parameters. We have Solaris 10, update 9.
Version of syslog-ng is 3.1.2. It is really terrible.

By terrible, I mean the packet loss, not the product:)) It is probably
something I don't have set up correctly.

Mike, check out that latest patch, it can't hurt. I had to open a case with
Sun to find out about it:))



On Fri, Apr 15, 2011 at 3:45 PM, Matthew Hall <mhall at mhcomputing.net> wrote:

> On Fri, Apr 15, 2011 at 02:01:50PM -0400, Mishou Michael wrote:
> > I left out the resources I have to work with on this system, and how
> > bad/good things are with syslog-ng running (and dropping), I'll include
> > those now.  As you can see, it's an older server, but it has a ton of
> > RAM and the CPUs should have enough pop for this I think.
>
> > I'm just not sure what to do next to troubleshoot.  I'm hoping someone
> > here can point me in the right direction, or at least confirm that they
> > are running syslog-ng in a similar configuration without drops so I know
> > that it's at least possible?
> >
> > Regards,
> >
> > --Mike
>
> I think the next suspect would be the disks. Can you disable anything that
> writes to disk or tell it to write to /dev/null and see if it still blows
> up?
>
> Also, it's Solaris, so you could start using some of the dtrace scripts to
> look for what syscalls / other ops are running too slow, and when it gets
> stuck what type of socket / disk file / what IO is it doing?
>
> Matthew.
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20110415/e9d50306/attachment.htm