[syslog-ng] Debugging tools for syslog-ng

[Balazs Scheidler]

----- Original message -----
> > this seems to be a bug in the sql destination. 1000 seems to be the
> window size for your source, the queue becomes filled, but then the sql
> destination doesn't flush messages.
> > or does it?
> Looks like it doesn't write anything after filling up to 1000. I spent a
> few hours on waiting for it to be flushed but got no results.
> log_iw_size for my source should be 20000:
> 
>         syslog(ip(0.0.0.0) transport("tcp") port(5141)
> max-connections(200) log_iw_size(20000) flags("threaded")
> log_fetch_limit(100));
> 

syslog driver divides the log-iw-size() evenly accross all permitted connections (max-connections() option), that way you get a window size of 100 for each connection.

> 
> 
> > it might also happen that it's slow. syslog-ng maxes out the queue,
> > then
> stops until messages are emptied. once there are free slots it starts
> again: fills it up, stalls.
> Looks like it never gets any free slots in my configuration since I don't
> see any logging after the queue is maxed out for a few hours.
> 

but you do see logging in the sql table for a while, then it stalls completely? that's interesting, and has no connection with window sizes, and seems to be a bug in sql.

> Could you give me any recommendations? Looks like log_iw_size just
> doesn't work for my source and I have no idea how to fix it.
> 

like I said above, it doesn't seem to be window or tuning related. the sql driver stalls, which shoudln't happen if your sql server is available.

Algernon, can you have a look? I don't when I can get there :(
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20121108/fdd589f4/attachment.htm