syslogd not draining

[Maxim Konovalov]

On Mon, 27 Mar 2006, 12:38-0500, Michael W. Lucas wrote:

> On Mon, Mar 27, 2006 at 06:18:50PM +0200, Borja Marcos wrote:
> > >I've got a machine running syslogd, DNS, DHCP, flow-capture, and other
> > >assorted UDP-loving programs.  Occasionally, they all stop working.
> > >The machine has been up for a couple of hours now, and I see:
> > >
> > >ns1/etc;netstat -s | grep full
> > >Warning: sysctl(net.inet6.ip6.rip6stats): No such file or directory
> > >        122066 dropped due to full socket buffers
> > >ns1/etc;
> > >
> > >I've doubled kern.ipc.maxsockbuf a couple of times now, and yet it
> > >still happens.

That's not enough.  You need to teach syslogd to use this new value.

> > >After some help from questions@, I'm pretty sure that the culprit is
> > >syslogd.
> > >
> > >udp4       0      0  *.67                   *.*
> > >udp4   43414      0  *.514                  *.*
> > >udp4       0      0  *.49661                *.*
> >
> > Are you using a serial console? I had similar problems in the past
> > due to the serial port flow control.
>
> I've disabled syslog to the console, writing instead to
> /var/log/console.log.
>
> Moments after doing that, the problem reoccured.  Thanks, Borja, but
> no success.  :-(
>
> Any other suggestions, folks?

What's the incoming udp datagrams rate?

netstat -sp udp | grep 'datagrams received'; sleep 10; \
netstat -sp udp | grep 'datagrams received'

How much cpu time does syslogd use?

-- 
Maxim Konovalov