[syslog-ng] Solaris 10 UDP overflows, message drops

[Fred Connolly]

My apologies to Matthew and Martin. I did not intend to jump in and take
over the thread. I just wanted to make Matthew and other Solaris 10
syslog-ng users aware that there is a recent kernel patch to address UDP
issues. The patch number is 144488-11. It is a Kernel patch so you might as
well apply the latest Recommended Patches, as it is included in that patch
set.

I will take Matthew's good suggestion and check out the loggen utility. I
was not aware that it existed and am going to look for the documentation as
soon as I hit Send.

I will also open up a separate thread to avoid any confusion:))



On Sat, Apr 16, 2011 at 11:25 PM, Martin Holste <mcholste at gmail.com> wrote:

> Shot in the dark: have you checked to be sure there aren't checksum
> errors in the packets?  Some kernels will drop bad checksummed
> packets.
>
> On Fri, Apr 15, 2011 at 8:27 PM, Fred Connolly <fred.connolly at gmail.com>
> wrote:
> > I am experiencing the same problem with Sun V490 except the server has
> about
> > 16gb memory. We are using UDP and losing about 85% of the traffic.  The
> > udpinoverflows is darn near equal to the total number of packets coming
> in.
> > I am not at work now so cannot provide accurate statistics at this time.
> The
> > NIC statistics are perfect, we aren't getting any errors with regards to
> the
> > UDP area etc.
> >
> > There is a kernel patch that came out about a week or two ago that deals
> in
> > this area, but I have not yet applied it. I want to apply the patch first
> > before adjusting other kernel parameters. We have Solaris 10, update 9.
> > Version of syslog-ng is 3.1.2. It is really terrible.
> >
> > By terrible, I mean the packet loss, not the product:)) It is probably
> > something I don't have set up correctly.
> >
> > Mike, check out that latest patch, it can't hurt. I had to open a case
> with
> > Sun to find out about it:))
> >
> >
> >
> > On Fri, Apr 15, 2011 at 3:45 PM, Matthew Hall <mhall at mhcomputing.net>
> wrote:
> >>
> >> On Fri, Apr 15, 2011 at 02:01:50PM -0400, Mishou Michael wrote:
> >> > I left out the resources I have to work with on this system, and how
> >> > bad/good things are with syslog-ng running (and dropping), I'll
> include
> >> > those now.  As you can see, it's an older server, but it has a ton of
> >> > RAM and the CPUs should have enough pop for this I think.
> >>
> >> > I'm just not sure what to do next to troubleshoot.  I'm hoping someone
> >> > here can point me in the right direction, or at least confirm that
> they
> >> > are running syslog-ng in a similar configuration without drops so I
> know
> >> > that it's at least possible?
> >> >
> >> > Regards,
> >> >
> >> > --Mike
> >>
> >> I think the next suspect would be the disks. Can you disable anything
> that
> >> writes to disk or tell it to write to /dev/null and see if it still
> blows
> >> up?
> >>
> >> Also, it's Solaris, so you could start using some of the dtrace scripts
> to
> >> look for what syscalls / other ops are running too slow, and when it
> gets
> >> stuck what type of socket / disk file / what IO is it doing?
> >>
> >> Matthew.
> >>
> >>
> ______________________________________________________________________________
> >> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> >> Documentation:
> >> http://www.balabit.com/support/documentation/?product=syslog-ng
> >> FAQ: http://www.campin.net/syslog-ng/faq.html
> >>
> >
> >
> >
> ______________________________________________________________________________
> > Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> > Documentation:
> > http://www.balabit.com/support/documentation/?product=syslog-ng
> > FAQ: http://www.campin.net/syslog-ng/faq.html
> >
> >
> >
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20110417/bccae807/attachment.htm