[syslog-ng] dropped udp packets and help with config

[Fred Connolly]

Thanks Gergely and Bazsi!!

My problem is that I don't have a test lab. Everything I try is in
production. I finally am getting a lab set up but we are looking at several
weeks out. I will try to test OSE 3.3 and see what happens as Bazsil
suggested and let you know how it turns out.

Gergely - A 4 second difference seems HUGE to me. I haven't looked at your
test program yet, but certainly will and give it a shot too, if I can.

Thanks for the help. I really appreciate it.

On Mon, May 23, 2011 at 12:04 PM, Gergely Nagy <algernon at balabit.hu> wrote:

> >>  We recently upgraded to Solaris 10 from Solaris 9 and I don't recall
> >> us dropping that
> >> many packets before. And we also upgraded from a very older Sylog-ng
> >> version to 3.1.2.
> >> I am basing the dropped packets on the udp stats, not syslog-ng stats.
> >> Syslog-ng stats has NO dropped packets.
> >
> > In another thread someone was complaining similar issues on Solaris. It
> > seems that the way syslog-ng writes log files (each line an individual
> > write system call), seems to have an enormous overhead on Solaris, much
> > more than on Linux.
>
> Attached is a program that tries to measure the speed difference between
> write() and writev(). It first writes N messages using write(), one by
> one, then it writes the same N messages using writev(), IOV_MAX message
> at a time.
>
> On both Linux and Solaris (OpenIndiana, actually, but shouldn't be much
> different on real Solaris), I get similar results: about 4 seconds for
> the write()s to finish, and below 1 second for writev().
>
> While the write()->writev() performance is noticable, the difference
> between Solaris and Linux seems to be so very tiny, that it is pretty
> much negligible.
>
> (Unless, of course, I screwed up the test program, which is entirely
> possible)
>
> --
> |8]
>
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20110523/898b1f01/attachment.htm