[syslog-ng] UDP Dropping packets

[Aldrich, Jamie S]

Is there a max size you can set the log_fifo_size?

Jamie


-----Original Message-----
From: syslog-ng-bounces at lists.balabit.hu [mailto:syslog-ng-bounces at lists.balabit.hu] On Behalf Of Martin Holste
Sent: Monday, August 29, 2011 11:56 AM
To: Syslog-ng users' and developers' mailing list
Subject: Re: [syslog-ng] UDP Dropping packets

While I've certainly seen UDP drop issues, setting
log_fifo_size(30000) has allowed my commodity systems to receive over
50k events/sec without drops on standard UDP, so unless you are
handling an extreme amount of logging or logging to a high-latency
destination (e.g. SQL), UDP should do just fine.

On Mon, Aug 29, 2011 at 10:48 AM, Aldrich, Jamie S <JSAldrich at pier1.com> wrote:
> Would using "tcp" be a worse option?
>
> Jamie
>
>
> -----Original Message-----
> From: syslog-ng-bounces at lists.balabit.hu [mailto:syslog-ng-bounces at lists.balabit.hu] On Behalf Of Balazs Scheidler
> Sent: Sunday, August 28, 2011 1:29 AM
> To: Syslog-ng users' and developers' mailing list
> Subject: Re: [syslog-ng] UDP Dropping packets
>
> On Fri, 2011-08-26 at 08:56 -0500, Aldrich, Jamie S wrote:
>> We are not writing these specific logs to the /var/adm/messages, but to a LogLogic devices.  Here is the syslog-ng.conf file part that handles these logs.
>>
>> source s_file {
>> file("/psfs_logs/APPSRV_current.LOG" flags(no-parse));
>> };
>>
>> destination d_messages{
>> udp("10.13.33.11");
>> };
>>
>> log {
>> source(s_file);
>> destination(d_messages);
>> };
>
> UDP is not reliable, and you could be surprised how much it is
> unreliable. I've seen udp transports to drop over 90% of the traffic.
>
> It can be improved somewhat by increasing the receive buffer size
> (so_rcvbuf() option in syslog-ng, but kernel limits may have to be
> adjusted as well).
>
> Google for udp receive buffer syslog-ng, and you'll get a number of
> pages that describe the issue.
>
> --
> Bazsi
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq