From owner-freebsd-hackers@FreeBSD.ORG  Mon Sep  3 00:20:47 2012
Return-Path: <owner-freebsd-hackers@FreeBSD.ORG>
Delivered-To: freebsd-hackers@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id 5FAE0106566C;
	Mon,  3 Sep 2012 00:20:47 +0000 (UTC)
	(envelope-from yanegomi@gmail.com)
Received: from mail-ob0-f182.google.com (mail-ob0-f182.google.com
	[209.85.214.182])
	by mx1.freebsd.org (Postfix) with ESMTP id 104DE8FC0A;
	Mon,  3 Sep 2012 00:20:46 +0000 (UTC)
Received: by obbun3 with SMTP id un3so10930097obb.13
	for <multiple recipients>; Sun, 02 Sep 2012 17:20:46 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;
	h=mime-version:in-reply-to:references:date:message-id:subject:from:to
	:cc:content-type;
	bh=/DY+NA0ULHCXzpgbTbVOfn7xwC8m/53m29EbpO7fZfo=;
	b=sUcmwKlr2WEAIgdH93uDJ8gBzK18auxmJ2kauzuW286dZ9vKBCbs8jOtomslbWgT5e
	Lu/FgFt/2YBYWp4Y+77fm3GohKazSChVXlQYDSK+2r7PVnGw6Q1UAwI6Bmv+bh9VCg18
	DVcxPIKgr1ZIVCQobhcwhnt7yLiwCVKp2GD3sfqPsCfUIL9i69hBOyC5wmEic3/hGMSe
	BOAmjGqIA4wNbfInAd2y1TJ1oKUWBKJbK/J/d1Bj67QpPLLVMupM8byiLrE105bvXLiT
	Erk195LyAoA162gG5wVOdeuwXqcAR1hFLau6K7Psvej1VhDDX8hwTZUvcP/9vBhLqlr3
	tCJw==
MIME-Version: 1.0
Received: by 10.60.2.134 with SMTP id 6mr12753160oeu.62.1346631646651; Sun, 02
	Sep 2012 17:20:46 -0700 (PDT)
Received: by 10.76.142.201 with HTTP; Sun, 2 Sep 2012 17:20:46 -0700 (PDT)
In-Reply-To: <CAJ-FndDeNVcEv5HRBMtQ5ZKa3zdWwt5d4fFPaoXnyV3MS31QDw@mail.gmail.com>
References: <CAJ-FndDeNVcEv5HRBMtQ5ZKa3zdWwt5d4fFPaoXnyV3MS31QDw@mail.gmail.com>
Date: Sun, 2 Sep 2012 17:20:46 -0700
Message-ID: <CAGH67wRuvJu6_2Z_sNi-iJoKsVruC0dNdO8yEg0JXKox8_pWuA@mail.gmail.com>
From: Garrett Cooper <yanegomi@gmail.com>
To: attilio@freebsd.org
Content-Type: text/plain; charset=ISO-8859-1
Cc: FreeBSD Hackers <freebsd-hackers@freebsd.org>
Subject: Re: syslog(3) issues
X-BeenThere: freebsd-hackers@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Technical Discussions relating to FreeBSD
	<freebsd-hackers.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-hackers>, 
	<mailto:freebsd-hackers-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-hackers>
List-Post: <mailto:freebsd-hackers@freebsd.org>
List-Help: <mailto:freebsd-hackers-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-hackers>,
	<mailto:freebsd-hackers-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 03 Sep 2012 00:20:47 -0000

On Sun, Sep 2, 2012 at 4:35 PM, Attilio Rao <attilio@freebsd.org> wrote:
> Hi,
> I was trying to use syslog(3) in a port application that uses
> threading , having all of them at the LOG_CRIT level. What I see is
> that when the logging gets massive (1000 entries) I cannot find some
> items within the /var/log/messages (I know because I started stamping
> also some sort of message ID in order to see what is going on). The
> missing items are in the order of 25% of what really be there.
>
> Someone has a good idea on where I can start verifying for my syslogd
> system? I have really 0 experience with syslogd and maybe I could be
> missing something obvious.

    I'd maybe use something like rsyslog and force TCP to verify that
the messages made it to their endpoints, and if all the messages make
it to the rsyslogd daemon use tcpdump/wireshark to figure out if the
UDP datagrams (default transport layer for syslog) aren't getting
dropped on the floor.
Cheers!
-Garrett