> > >> > it's making a huge number of syscalls, and flushing output to disk, so I > guess this would show as iowait time, not cpu time for the program. >
Makes sense. > > As I mentioned, stats outside and inside rsyslog looked ok: >> >> 1. "netstat -anus" would display no increase in "packet receive errors" >> while "packet received" seemed to match the expected results. >> 2. I could not see a change in discarded.full, discarded.nf within the >> pstats output. >> >> >> Wouldn't dropped UDP packets and discarded due to full buffers be >> discarded >> and the counter of "packet receive errors" increased? >> > > no, there is another queue you are not thinking of > > the OS has it's UDP buffers, if things overflow those buffers, rsyslog > never knows the packet existed, so it can't account for them. There is a > way in netstat to show when the buffer was full, but it doesn't count as a > recieve error because UDP is allowed to be dropped if there is congestion. > But "netstat -us" should show the dropped packets due to full queues, at least it did it very very very clearly when I was running the same tests against syslog-ng. If the "-us" is not indication of drops then there is a good amount of sites presenting partially correct information (sample): http://prefetch.net/blog/index.php/2011/07/11/using-netstat-and-dropwatch-to-observe-packet-loss-on-linux-servers/ https://blog.cloudflare.com/how-to-receive-a-million-packets/ https://www.balabit.com/documents/syslog-ng-pe-5.4-guides/en/syslog-ng-tutorial-udp-source/html-single/index.html http://www-01.ibm.com/support/knowledgecenter/SSQPD3_2.6.0/com.ibm.wllm.doc/cgmgt_symptomsofnetworkcongestion.html I any case, changing the setting seems to have produced a very good outcome. Ideally I would prefer having no UDP clients at all in any case. Thanks _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
