[syslog-ng] Solaris 10 UDP overflows, message drops

[Zeek Anow]

Just a heads up Mike. I tried doing the same thing with regards to using
loggen to find the best rate on my V490. My version of loggen did not have
the --active-connections parameter for sure, and I think it didn't have the
--idle connection parameter either. I set the -I to 600 for 10 minutes, and
that didn't work either. It ran until I manually killed it about 25 minutes
later.

Then for the output all I got was :
count=14877   diff=15930    rate = 627.75

I haven't found what they mean yet. I reckon count would be the number of
packets sent, not sure what diff is, but I know what the msg/sec is:))

I am curious to see what you come up with. Oh, did you use the SunFreeware
version or did you compile it yourself?



On Tue, Apr 26, 2011 at 1:58 PM, Mishou Michael <
Michael.Mishou at csirc.irs.gov> wrote:

> Gergely,
>
> Thanks for any testing you can do.  I'm not sure if a SPARC processor is
> an important testing component or not, I suppose your VMs will help
> determine this since you'll be using x86.  If there's any testing I can
> do to help things along, please let me know.
>
> Yes, I'm (very) scared of rsyslog as a maintainable solution, the
> configs for syslog-ng are *so* much easier to read and understand.  I'll
> try 3.3 and report back how threading helps things out, I'm glad to hear
> that it's been pretty stable for you, that was my major concern in
> testing 3.3 since eventually we'll need this to be in production with
> our basic (from a config complexity standpoint) requirements.
>
> I'll report back how 3.3 works out for me after I get it compiled and up
> today.
>
> Regards,
>
> --Mike
>
> -----Original Message-----
> From: syslog-ng-bounces at lists.balabit.hu
> [mailto:syslog-ng-bounces at lists.balabit.hu] On Behalf Of Gergely Nagy
> Sent: Tuesday, April 26, 2011 12:19 PM
> To: Syslog-ng users' and developers' mailing list
> Subject: Re: [syslog-ng] Solaris 10 UDP overflows, message drops
>
> (A few preliminary answers follow - I'll have another look at this later
> tonight from home, once I tested a few things on my local solaris vm)
>
> "Mishou Michael" <Michael.Mishou at csirc.irs.gov> writes:
>
> > I'm going to experiment with syslog-ng and the loggen tool to find a
> > point at which a single syslog-ng instance starts dropping inbound UDP
> > traffic with a simple configuration writing to disk.  Once I have that
> > number, I have a few options:
> >
> > 1.  Experiment with syslog-ng 3.3 and the new threaded code to see if
> I
> > have performance gains.  I'm hesitant to push Alpha code in
> production,
> > if anyone has any experience with 3.3 in semi-production environment
> > running consistently I'd love to hear it.
>
> I've been running 3.3 on most systems I administer (2 of my own servers
> + a few I administer for friends; and all of my virtual machines). It's
> been serving me fine for the past 4 months now.
>
> However, most of my systems are also linux systems, where syslog-ng is
> much better tested (and I'm not using UDP at all).
>
> Personally, I'd give it a test run, as current 3.3 is fairly stable.
>
> > 3.  Give up on syslog-ng until 3.3, or move to some other solution.
> Not
> > sure what I could do here, rsyslog is the other major contender I
> guess,
> > not sure what gains I would get.  Could also do native syslog server
> and
> > post-process to different buckets/relay which is what we mainly use
> > syslog-ng for.
>
> I wouldn't consider rsyslog. It's a nightmare to maintain that, and an
> even bigger nightmare to get it to perform well in any but the most
> trivial situations. (Or it might be just me being too used to good
> documentation and readable config files, but I'm fairly sure it's not
> just that :P)
>
> --
> |8]
> ________________________________________________________________________
> ______
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20110426/3a5d6935/attachment-0001.htm