From owner-freebsd-performance@FreeBSD.ORG Thu Dec 8 08:31:40 2005 Return-Path: X-Original-To: freebsd-performance@freebsd.org Delivered-To: freebsd-performance@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 73C5516A420 for ; Thu, 8 Dec 2005 08:31:40 +0000 (GMT) (envelope-from imriz@co.zahav.net.il) Received: from mrx.wan.inter.net.il (mrx.wan.inter.net.il [192.117.191.51]) by mx1.FreeBSD.org (Postfix) with SMTP id 1C4B343D79 for ; Thu, 8 Dec 2005 08:31:28 +0000 (GMT) (envelope-from imriz@co.zahav.net.il) Received: from igfe.InetGold ([172.33.1.137]) by mrx.wan.inter.net.il (SAVSMTP 3.1.0.29) with SMTP id M2005120810322927914 ; Thu, 08 Dec 2005 10:32:29 +0200 Received: from IGMAIL.InetGold ([172.31.100.164]) by igfe.InetGold with Microsoft SMTPSVC(6.0.3790.1830); Thu, 8 Dec 2005 10:31:06 +0200 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Date: Thu, 8 Dec 2005 10:36:33 +0200 Message-ID: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: very busy syslog server Thread-Index: AcX7Xoyfe1qH67BURe693YO6GW3j6gActbsw From: "Imri Zvik" To: "Sean Chittenden" X-OriginalArrivalTime: 08 Dec 2005 08:31:06.0741 (UTC) FILETIME=[BBCC9250:01C5FBD1] Cc: freebsd-performance@freebsd.org Subject: RE: very busy syslog server X-BeenThere: freebsd-performance@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Performance/tuning List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Dec 2005 08:31:40 -0000 Hi, I have tried polling, and it did not improve the performance. Regarding the inserts - I am using delayed inserts to solve that problem exactly. I have already tried to log into files, and still had this issue... Thanks for reply :) -- Imri Zvik PGP (2.6.3ia) Public Key: http://mariska.inter.net.il/~imriz/imriz.pgp =20 -----Original Message----- From: Sean Chittenden [mailto:sean@gigave.com]=20 Sent: Wednesday, December 07, 2005 8:41 PM To: Imri Zvik Cc: freebsd-performance@freebsd.org Subject: Re: very busy syslog server > I'm trying to setup a syslog server to serve a large group of > servers. For the syslog daemon, I have chosen rsyslogd, and the > backend is mysql (on a different machine). >=20 > The machine has 2 Intel Xeon 2.80GHz CPUs, and 1GB of RAM, and it is > running FreeBSD 6 (6.0-STABLE). >=20 > The problem is, that I see a lot of UDP packets being dropped: >=20 > udp: > 390202 datagrams received > 0 with incomplete header > 0 with bad data length field > 0 with bad checksum > 6 with no checksum > 0 dropped due to no socket > 0 broadcast/multicast datagrams dropped due to no socket > ->>> 123677 dropped due to full socket buffers > 0 not for hashed pcb > 266525 delivered > 133260 datagrams output >=20 > I have tried to increase net.inet.udp.recvspace, but it didn't solve > the problem. >=20 > I would appreciate any hint or tips. When you're doing a large number of packets per second, you may want to look into enabling device polling(4). Right now, every packet results in an interrupt. With device polling, you can handle more than one packet per interrupt. See the man page for details. If your syslogd's are blocking, waiting for the MySQL INSERT to complete, you may be dropping UDP packets and polling won't help you. I'd write messages out to a file then process them once a minute. *shrug* -sc --=20 Sean Chittenden