[syslog-ng] Solaris 10 UDP overflows, message drops

[Fekete Robert]

Hi,

UDP is a connection-less protocol, meaning that the sender has no knowledge if 
the messages reach the destination or not. In the perspective of flow-control, 
this means the following (someone please correct me if I'm wrong):

- when using flow-control on the client that sends messages via UDP, 
flow-control can slow down reading messages from the client's sources if the 
client cannot send out the messages fast enough. But the client does not know 
(hence it cannot slow down) if the server cannot handle the messages it receives.

- when using flow-control on the server that receives UDP messages, flow-control 
can slow down reading from the server's sources (thus probably cause the server 
to drop UDP messages) if the destination on the server (file, database, 
whatever) cannot handle the messages send to the destination fast enough.

Robert

On 04/29/2011 01:11 AM, Zeek Anow wrote:

> Sorry for the extra posts. Can't think straight today:))
> Are you using flow-control? I went back to your first couple of posts and didn't
> see it mentioned.
> At first I thought it was for only TCP, but then I found it in the manual under
> log path flags and it didn't say it was only for TCP.
>
> f l o w - control-    Enables flow-control to the log path, meaning that
> syslog-ng will stop reading messages from the sources
> of this log statement if the destinations are not able to process the messages
> at the required speed. If
> disabled, syslog-ng will drop messages if the destination queues are full. If
> enabled, syslog-ng will only
> drop messages if the destination queues/window sizes are improperly sized.
>
> On Thu, Apr 28, 2011 at 6:56 PM, Zeek Anow <zeekstern at gmail.com
> <mailto:zeekstern at gmail.com>> wrote:
>
>     Mike - You asked earlier about if anyone knows a way to figure out when our
>     pieces of junk starts to get pegged:)) Check this out:
>
>     http://blogs.balabit.com/2011/02/07/syslog-ng-performance-tuning
>
>     I know it is for TCP, but you can still probably get some use out of it. The
>     only thing I question is why he never changed the log_iw_size.**
>
>     Hope it helps..
>
>
>     On Thu, Apr 28, 2011 at 12:46 PM, Zeek Anow <zeekstern at gmail.com
>     <mailto:zeekstern at gmail.com>> wrote:
>
>         That would be great. Thanks!!
>
>
>         On Thu, Apr 28, 2011 at 11:33 AM, Gergely Nagy <algernon at balabit.hu
>         <mailto:algernon at balabit.hu>> wrote:
>
>             Zeek Anow <zeekstern at gmail.com <mailto:zeekstern at gmail.com>> writes:
>
>              > Thanks. Will do.
>              > What is git:))
>
>             A version control system :]
>
>             Come to think of it, it's probably easier for everyone if I prepare a
>             tarball from Bazsi's latest version, with bells & whistles included.
>
>             I'll try not to forget, but if I don't post back with a link within a
>             day, please remind me O:)
>
>             --
>             |8]
>             ______________________________________________________________________________
>             Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
>             Documentation:
>             http://www.balabit.com/support/documentation/?product=syslog-ng
>             FAQ: http://www.campin.net/syslog-ng/faq.html
>
>
>
>
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>