Re: Syslog dropping messages, udp buffer full

it sounds like the amount of logs being sent to the server are more then
it can write to disk in a given time period.

you might want to try to reduce the logs sent, to filter them (log only
messages with a higher level or from certain facilities), or make the
disks on the remote server faster - replacing them with faster disks, or
replacing them with a RAID in a faster configuration, etc.

--guy

On Mon, 2011-01-31 at 16:07 +0000, Lynch, Jonathan wrote:
> Hi here,
>
>
>
> We have been using remote syslogging on RHEL5. However, after starting
> the service, it takes longer and longer for the messages to appear in
> the log file until they are missed entirely, or only part of a set of
> messages will be received.
>
>
>
> I checked the udp stats, and it showed many UDP receive errors.
> However, a newwork dump reveals that the packets are reaching the
> computer properly.
>
>
>
> I tried increasing the udp buffers, but that merely increased the time
> it takes before the buffer gets full and messages start getting
> dropped.
>
>
>
> Any ideas?
>
>
>
> Thanks,
>
> Jonathan
>
>
>
>
Received on Sun Feb 06 2011 - 23:20:18 CET