From owner-freebsd-questions@FreeBSD.ORG Tue Jan 20 11:12:47 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id DADF716A4CE for ; Tue, 20 Jan 2004 11:12:47 -0800 (PST) Received: from dan.emsphone.com (dan.emsphone.com [199.67.51.101]) by mx1.FreeBSD.org (Postfix) with ESMTP id B9E5243D66 for ; Tue, 20 Jan 2004 11:12:46 -0800 (PST) (envelope-from dan@dan.emsphone.com) Received: (from dan@localhost) by dan.emsphone.com (8.12.10/8.12.10) id i0KJCNOC073989; Tue, 20 Jan 2004 13:12:23 -0600 (CST) (envelope-from dan) Date: Tue, 20 Jan 2004 13:12:23 -0600 From: Dan Nelson To: Brent Bailey Message-ID: <20040120191223.GA362@dan.emsphone.com> References: <1311.66.63.97.2.1074618159.squirrel@new.host.name> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1311.66.63.97.2.1074618159.squirrel@new.host.name> X-OS: FreeBSD 5.2-CURRENT X-message-flag: Outlook Error User-Agent: Mutt/1.5.5.1i cc: questions@freebsd.org Subject: Re: UDP errors and syslog & BSD X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Jan 2004 19:12:48 -0000 In the last episode (Jan 20), Brent Bailey said: > Im using Frebsd as a syslog server at work. Everything seemed to be ok > untill i decided to run > "netstat -s -p udp" > as part of my nitely reporting. there are 5 routers pointed at this syslog > server so it seen ALOT of UDP traffic > > ive noticed the following : > UDP stats: > > the errors im concerned about are > 5775699 dropped due to full socket buffers I think this means that a process isn't reading data fast enough from its socket. It's not a global buffer shortage (you'd get lots of errros in /var/log/mesages in that case). You can raise the buffer size for a specific socket by calling setsockopt() with the SO_RCVBUF option. You can change the systemwide default with the net.inet.udp.recvspace sysctl. > and > 319427 dropped due to no socket This just counts the number of packets sent to UDP ports where there was no listening process. Say for example you had to stop and restart syslogd, any syslog packets received while it was down would increment that counter. -- Dan Nelson dnelson@allantgroup.com