folks, thanks for looking at the network layer. I have thought a bit about what we could do from the rsyslog side to get more reliable results, but I think it is better if I back off until we get stable stats from the network layer. So I standby and will chime back in as soon as we are ready to look at rsyslog again (pls ping me if I miss that very moment!).
Thanks, Rainer On Tue, Oct 1, 2013 at 8:35 AM, David Lang <[email protected]> wrote: > On Mon, 30 Sep 2013, Robert wrote: > > The way I calculated the bytes was by getting the cacti reading, 590Mb -> >> ÷ 250,000 eps = 310 bytes ÷ 8 sources = 39bytes ? Hopefully I did the math >> right. >> > > is one 'event' from spirent one log message or on log message from each > source? (the stats you have been providing are not showing that the > distribution of events is even) > > I would say 590Mb / 250,000 = 310 bytes per log message (which includes > some packet overhead). > > 310 bytes per log message seems quite reasonable > > > When I ramp up the spirent to 250k eps, the tcpdump command shows ~ 232k >> > > this seems to me like you are loosing messages at the network/kernel level > before you even get to rsyslog. is tcpdump clamining that some messages > were dropped by the kernel? or is it thinking that it's got everything? > > if you drop the rate to 220,000 events per second, does tcpdump indicate > you are getting them all? > > David Lang > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
