[syslog-ng] Solaris 10 UDP overflows, message drops

[Matthew Hall]

Checksum issues should trigger ifInDiscards type MIB counters instead of udpOverflow type counters.

Hit the thing with syslog-ng's loggen utility and figure out when it keels over.

There's GOT to be a choke point that can be found scientifically.

Matthew.

On Sat, Apr 16, 2011 at 10:25:53PM -0500, Martin Holste wrote:
> Shot in the dark: have you checked to be sure there aren't checksum
> errors in the packets?  Some kernels will drop bad checksummed
> packets.
> 
> On Fri, Apr 15, 2011 at 8:27 PM, Fred Connolly <fred.connolly at gmail.com> wrote:
> > I am experiencing the same problem with Sun V490 except the server has about
> > 16gb memory. We are using UDP and losing about 85% of the traffic.  The
> > udpinoverflows is darn near equal to the total number of packets coming in.
> > I am not at work now so cannot provide accurate statistics at this time. The
> > NIC statistics are perfect, we aren't getting any errors with regards to the
> > UDP area etc.
> >
> > There is a kernel patch that came out about a week or two ago that deals in
> > this area, but I have not yet applied it. I want to apply the patch first
> > before adjusting other kernel parameters. We have Solaris 10, update 9.
> > Version of syslog-ng is 3.1.2. It is really terrible.
> >
> > By terrible, I mean the packet loss, not the product:)) It is probably
> > something I don't have set up correctly.
> >
> > Mike, check out that latest patch, it can't hurt. I had to open a case with
> > Sun to find out about it:))
> >
> >
> >
> > On Fri, Apr 15, 2011 at 3:45 PM, Matthew Hall <mhall at mhcomputing.net> wrote:
> >>
> >> On Fri, Apr 15, 2011 at 02:01:50PM -0400, Mishou Michael wrote:
> >> > I left out the resources I have to work with on this system, and how
> >> > bad/good things are with syslog-ng running (and dropping), I'll include
> >> > those now.  As you can see, it's an older server, but it has a ton of
> >> > RAM and the CPUs should have enough pop for this I think.
> >>
> >> > I'm just not sure what to do next to troubleshoot.  I'm hoping someone
> >> > here can point me in the right direction, or at least confirm that they
> >> > are running syslog-ng in a similar configuration without drops so I know
> >> > that it's at least possible?
> >> >
> >> > Regards,
> >> >
> >> > --Mike
> >>
> >> I think the next suspect would be the disks. Can you disable anything that
> >> writes to disk or tell it to write to /dev/null and see if it still blows
> >> up?
> >>
> >> Also, it's Solaris, so you could start using some of the dtrace scripts to
> >> look for what syscalls / other ops are running too slow, and when it gets
> >> stuck what type of socket / disk file / what IO is it doing?
> >>
> >> Matthew.
> >>
> >> ______________________________________________________________________________
> >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> >> Documentation:
> >> http://www.balabit.com/support/documentation/?product=syslog-ng
> >> FAQ: http://www.campin.net/syslog-ng/faq.html
> >>
> >
> >
> > ______________________________________________________________________________
> > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> > Documentation:
> > http://www.balabit.com/support/documentation/?product=syslog-ng
> > FAQ: http://www.campin.net/syslog-ng/faq.html
> >
> >
> >
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>