Date: Mon, 27 Mar 2006 13:15:01 -0500 From: "Michael W. Lucas" <mwlucas@blackhelicopters.org> To: Maxim Konovalov <maxim@macomnet.ru> Cc: hackers@freebsd.org Subject: Re: syslogd not draining Message-ID: <20060327181501.GA58448@bewilderbeast.blackhelicopters.org> In-Reply-To: <20060327214209.U87890@mp2.macomnet.net> References: <20060327160130.GA57689@bewilderbeast.blackhelicopters.org> <20F3E06D-5727-4531-A81B-DF64765D1564@SARENET.ES> <20060327173841.GA58274@bewilderbeast.blackhelicopters.org> <20060327214209.U87890@mp2.macomnet.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, Mar 27, 2006 at 10:01:42PM +0400, Maxim Konovalov wrote:
> On Mon, 27 Mar 2006, 12:38-0500, Michael W. Lucas wrote:
>
> > On Mon, Mar 27, 2006 at 06:18:50PM +0200, Borja Marcos wrote:
> > > >I've got a machine running syslogd, DNS, DHCP, flow-capture, and other
> > > >assorted UDP-loving programs. Occasionally, they all stop working.
> > > >The machine has been up for a couple of hours now, and I see:
> > > >
> > > >ns1/etc;netstat -s | grep full
> > > >Warning: sysctl(net.inet6.ip6.rip6stats): No such file or directory
> > > > 122066 dropped due to full socket buffers
> > > >ns1/etc;
> > > >
> > > >I've doubled kern.ipc.maxsockbuf a couple of times now, and yet it
> > > >still happens.
>
> That's not enough. You need to teach syslogd to use this new value.
I don't see this in syslogd(8); I presume it require source hacking?
> > > >After some help from questions@, I'm pretty sure that the culprit is
> > > >syslogd.
> > > >
> > > >udp4 0 0 *.67 *.*
> > > >udp4 43414 0 *.514 *.*
> > > >udp4 0 0 *.49661 *.*
> > >
> > > Are you using a serial console? I had similar problems in the past
> > > due to the serial port flow control.
> >
> > I've disabled syslog to the console, writing instead to
> > /var/log/console.log.
> >
> > Moments after doing that, the problem reoccured. Thanks, Borja, but
> > no success. :-(
> >
> > Any other suggestions, folks?
>
> What's the incoming udp datagrams rate?
>
> netstat -sp udp | grep 'datagrams received'; sleep 10; \
> netstat -sp udp | grep 'datagrams received'
158169 dropped due to full socket buffers
2467251 datagrams received
sleeping...
158903 dropped due to full socket buffers
2468299 datagrams received
> How much cpu time does syslogd use?
Not much. ps -ax | grep syslog gives:
4317 ?? Ss 0:01.60 /usr/sbin/syslogd -l /var/run/log -l /var/named/var/run/log
Process has been running for about five minutes at that point.
Another point that might be of interest:
ns1/etc;rc.d/syslogd restart
Stopping syslogd.
Waiting for PIDS: 4317, 4317, 4317, 4317, 4317, 4317, 4317, 4317, 4317, 4317, 4317, 4317, 4317, 4317, 4317, 4317, 4317, 4317
Starting syslogd.
==ml
--
Michael W. Lucas mwlucas@FreeBSD.org, mwlucas@BlackHelicopters.org
http://www.BlackHelicopters.org/~mwlucas/
"The cloak of anonymity protects me from the nuisance of caring." -Non Sequitur
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20060327181501.GA58448>