syslogd not draining

[Maxim Konovalov]

[....]
> > > > >ns1/etc;netstat -s | grep full
> > > > >Warning: sysctl(net.inet6.ip6.rip6stats): No such file or directory
> > > > >        122066 dropped due to full socket buffers
> > > > >ns1/etc;
> > > > >
> > > > >I've doubled kern.ipc.maxsockbuf a couple of times now, and yet it
> > > > >still happens.
> >
> > That's not enough.  You need to teach syslogd to use this new value.
>
> I don't see this in syslogd(8); I presume it require source hacking?

Yes.

[...]
> > netstat -sp udp | grep 'datagrams received'; sleep 10; \
> > netstat -sp udp | grep 'datagrams received'
>
>         158169 dropped due to full socket buffers
>         2467251 datagrams received
> 	sleeping...
>         158903 dropped due to full socket buffers
>         2468299 datagrams received

~100 datagrams per second, not a lot.  Perhaps they are huge.

> > How much cpu time does syslogd use?
>
> Not much.  ps -ax | grep syslog gives:
>
>  4317 ??  Ss 0:01.60 /usr/sbin/syslogd -l /var/run/log -l
>  /var/named/var/run/log

Try to remove a log socket for named and restart syslogd.

> Process has been running for about five minutes at that point.
>
> Another point that might be of interest:
>
> ns1/etc;rc.d/syslogd restart Stopping syslogd. Waiting for PIDS:
> 4317, 4317, 4317, 4317, 4317, 4317, 4317, 4317, 4317, 4317, 4317,
> 4317, 4317, 4317, 4317, 4317, 4317, 4317 Starting syslogd.

What's the /var filesystem type?  Something like gmirror?

diff -u /etc/syslog.conf /usr/src/etc/syslog.conf?

-- 
Maxim Konovalov