[syslog-ng] Solaris 10 UDP overflows, message drops

[Martin Holste]

Shot in the dark: have you checked to be sure there aren't checksum
errors in the packets?  Some kernels will drop bad checksummed
packets.

On Fri, Apr 15, 2011 at 8:27 PM, Fred Connolly <fred.connolly at gmail.com> wrote:
> I am experiencing the same problem with Sun V490 except the server has about
> 16gb memory. We are using UDP and losing about 85% of the traffic.  The
> udpinoverflows is darn near equal to the total number of packets coming in.
> I am not at work now so cannot provide accurate statistics at this time. The
> NIC statistics are perfect, we aren't getting any errors with regards to the
> UDP area etc.
>
> There is a kernel patch that came out about a week or two ago that deals in
> this area, but I have not yet applied it. I want to apply the patch first
> before adjusting other kernel parameters. We have Solaris 10, update 9.
> Version of syslog-ng is 3.1.2. It is really terrible.
>
> By terrible, I mean the packet loss, not the product:)) It is probably
> something I don't have set up correctly.
>
> Mike, check out that latest patch, it can't hurt. I had to open a case with
> Sun to find out about it:))
>
>
>
> On Fri, Apr 15, 2011 at 3:45 PM, Matthew Hall <mhall at mhcomputing.net> wrote:
>>
>> On Fri, Apr 15, 2011 at 02:01:50PM -0400, Mishou Michael wrote:
>> > I left out the resources I have to work with on this system, and how
>> > bad/good things are with syslog-ng running (and dropping), I'll include
>> > those now.  As you can see, it's an older server, but it has a ton of
>> > RAM and the CPUs should have enough pop for this I think.
>>
>> > I'm just not sure what to do next to troubleshoot.  I'm hoping someone
>> > here can point me in the right direction, or at least confirm that they
>> > are running syslog-ng in a similar configuration without drops so I know
>> > that it's at least possible?
>> >
>> > Regards,
>> >
>> > --Mike
>>
>> I think the next suspect would be the disks. Can you disable anything that
>> writes to disk or tell it to write to /dev/null and see if it still blows
>> up?
>>
>> Also, it's Solaris, so you could start using some of the dtrace scripts to
>> look for what syscalls / other ops are running too slow, and when it gets
>> stuck what type of socket / disk file / what IO is it doing?
>>
>> Matthew.
>>
>> ______________________________________________________________________________
>> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>> Documentation:
>> http://www.balabit.com/support/documentation/?product=syslog-ng
>> FAQ: http://www.campin.net/syslog-ng/faq.html
>>
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
>
>