very busy syslog server

[Imri Zvik]

Hi!

I'm trying to setup a syslog server to serve a large group of servers.
For the syslog daemon, I have chosen rsyslogd, and the backend is mysql (on a different machine).

The machine has 2 Intel Xeon 2.80GHz CPUs, and 1GB of RAM, and it is running FreeBSD 6 (6.0-STABLE).

The problem is, that I see a lot of UDP packets being dropped:

udp:
        390202 datagrams received
        0 with incomplete header
        0 with bad data length field
        0 with bad checksum
        6 with no checksum
        0 dropped due to no socket
        0 broadcast/multicast datagrams dropped due to no socket
->>>    123677 dropped due to full socket buffers
        0 not for hashed pcb
        266525 delivered
        133260 datagrams output

I have tried to increase net.inet.udp.recvspace, but it didn't solve the problem.

I would appreciate any hint or tips.


Thank you in advance!

--
Imri Zvik
PGP (2.6.3ia) Public Key: http://mariska.inter.net.il/~imriz/imriz.pgp