Date: Thu, 22 Mar 2012 11:54:00 +0000 From: Mark Blackman <mark@exonetric.com> To: Traiano Welcome <Traiano.Welcome@mtnbusiness.co.za> Cc: freebsd questions <freebsd-questions@freebsd.org> Subject: Re: FreeBSD: syslog-ng: I/O error occurred while writing; fd='xx', error='No buffer space available (yy)' Message-ID: <F4E891E9-138A-447D-8FC6-83CD2C91CCAF@exonetric.com> In-Reply-To: <CB90C5AC.DD61%traiano.welcome@mtnbusiness.co.za> References: <CB90C5AC.DD61%traiano.welcome@mtnbusiness.co.za>
next in thread | previous in thread | raw e-mail | index | archive | help
On 22 Mar 2012, at 11:40, Traiano Welcome wrote: > That's what I thought as well, but it's the details that evade me. = Almost > all traffic to and from this server is UDP (syslog), the graph I sent > earlier shows the kind of volumes and trends that are typical: Peak > traffic during the problem periods averages at about 1 Mbps outbound = and > 200 Kbps inbound to/from the interface. The interface itself is a > Embedded Broadcom 5708 NIC on a Dell PowerEdge 1950. >=20 >=20 > Here are a couple of netstat polls during one of the problem periods: >=20 > ---- > [root@syslog2]# date;netstat -p udp -s |egrep -w > "(received|delivered|dropped)" > Thu Mar 22 12:11:34 SAST 2012 > 19969 datagrams received > 2 dropped due to no socket > 0 dropped due to full socket buffers > 19967 delivered > . > . > . > [root@syslog2~]# date;netstat -p udp -s |egrep -w > "(received|delivered|dropped)" > Thu Mar 22 13:36:46 SAST 2012 > 662385 datagrams received > 118 dropped due to no socket > 0 dropped due to full socket buffers > 662267 delivered > --- >=20 >=20 > Somehow this doesn't strike me as a large volume of throughput =85 Ok, fair enough. You might try simulating the problem by deliberately = overloading the syslog UDP output and confirm the cause. - Mark=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?F4E891E9-138A-447D-8FC6-83CD2C91CCAF>