UDP errors and syslog & BSD

[Dan Nelson]

In the last episode (Jan 20), Brent Bailey said:
> Im using Frebsd as a syslog server at work. Everything seemed to be ok
> untill i decided to run
> "netstat -s -p udp"
> as part of my nitely reporting. there are 5 routers pointed at this syslog
> server so it seen ALOT of UDP traffic
> 
> ive noticed the following :
> UDP stats:
> 
> the errors im concerned about are
> 5775699 dropped due to full socket buffers

I think this means that a process isn't reading data fast enough from
its socket.  It's not a global buffer shortage (you'd get lots of
errros in /var/log/mesages in that case).  You can raise the buffer
size for a specific socket by calling setsockopt() with the SO_RCVBUF
option.  You can change the systemwide default with the
net.inet.udp.recvspace sysctl.
 
> and
>  319427 dropped due to no socket

This just counts the number of packets sent to UDP ports where there
was no listening process.  Say for example you had to stop and restart
syslogd, any syslog packets received while it was down would increment
that counter.

-- 
	Dan Nelson
	dnelson at allantgroup.com