For the same reason that remote calls don't work... the consumer can't
keep up. This is not a hard synchronous call, otherwise if you filled
syslog too fast your system might suffer other very bad effects. Its an
IPC and it can be overrun on the producer side.
If you spew too much garbage, you'll lose something. Consider logs a
best effort transport, not a reliable one.
In fact, if you have to log more than one or two messages in an
exceptional case, then you're doing something wrong. syslog is meant
for exceptional use, not for massive amounts of data collection.
- Garrett
On Thu, 2010-07-22 at 22:10 -0400, Paul Robertson wrote:
> Our application calls syslog(3c) to write to the local syslog daemon,
> and we were puzzled when some messages weren't appearing in the local
> /var/adm/messages file. We wrote a test program to spew 60000 unique
> messages, and confirmed that not all syslog calls result in
> corresponding entries in /var/adm/messages.
>
> Here's the sample program:
>
> $ cat Main.cpp
> #include <string>
> #include "syslog.h"
>
> void *makeConnection(void *v)
> {
> int start = (int)v;
> char buffer[10];
>
> for (int i = start; i <start + 10000; i++)
> {
> sprintf(buffer, "%d", i);
> syslog(LOG_NOTICE, buffer);
> }
> }
>
> int main(int argc, char *argv[])
> {
> openlog(argv[1], LOG_PID, LOG_DAEMON);
>
> pthread_t thr1;
> pthread_create(&thr1, NULL, makeConnection, (void *)1);
>
> pthread_t thr2;
> pthread_create(&thr2, NULL, makeConnection, (void *)10001);
>
> pthread_t thr3;
> pthread_create(&thr3, NULL, makeConnection, (void *)20001);
>
> pthread_t thr4;
> pthread_create(&thr4, NULL, makeConnection, (void *)30001);
>
> pthread_t thr5;
> pthread_create(&thr5, NULL, makeConnection, (void *)40001);
>
> pthread_t thr6;
> pthread_create(&thr6, NULL, makeConnection, (void *)50001);
>
> pthread_join(thr1, NULL);
> pthread_join(thr2, NULL);
> pthread_join(thr3, NULL);
> pthread_join(thr4, NULL);
> pthread_join(thr5, NULL);
> pthread_join(thr6, NULL);
>
> closelog();
> }
>
> Compile as follows:
>
> $ g++ -o syslogTest Main.cpp -lposix4 -lthread
>
> In the following session, dtrace shows 60000 syslog opens, but fewer
> than 40000 entries were written to /var/adm/messages.
>
> $ uname -a
> SunOS tulip 5.11 snv_134 i86pc i386 i86pc
>
> First, I nuke /var/adm/messages to ensure that we're starting with a
> clean slate, and then call the syslogTest program via dtrace to
> confirm the number of syslog calls.
>
> # pfexec cp /dev/null /var/adm/messages
> # pfexec dtrace -n 'pid$target::syslog:entry { @num[execname] = count() ;
> }' -c syslogTest
> dtrace: description 'pid$target::syslog:entry ' matched 1 probe
> dtrace: pid 699 has exited
>
> syslogTest 60000
>
> Unfortunately, less than sixty thousand messages were written to
> /var/adm/messages:
>
> $ wc -l /var/adm/messages
> 36855 /var/adm/messages
>
> The number of entries in /var/adm/messages varies, but is typically
> between thirty and forty thousand. I understand the remote syslog
> connections via UDP are not reliable, but I'm puzzled why _local_
> syslog calls would fail to result in corresponding entries in
> /var/adm/messages.
>
> Any assistance is much appreciated.
>
> Cheers,
>
> Paul
>
_______________________________________________
opensolaris-code mailing list
opensolaris-code@opensolaris.org
http://mail.opensolaris.org/mailman/listinfo/opensolaris-code
