FreeBSD: syslog-ng: I/O error occurred while writing; fd='xx', error='No buffer space available (yy)'

[Mark Blackman]

On 22 Mar 2012, at 11:40, Traiano Welcome wrote:

> That's what I thought as well, but it's the details that evade me. Almost
> all traffic to and from this server is UDP (syslog), the graph I sent
> earlier shows the kind of volumes and trends that are typical: Peak
> traffic during the problem periods averages at about 1 Mbps outbound and
> 200 Kbps inbound to/from the interface. The interface itself is a
> Embedded Broadcom 5708 NIC on a Dell PowerEdge 1950.
> 
> 
> Here are a couple of netstat polls during one of the problem periods:
> 
> ----
> [root at syslog2]# date;netstat -p udp -s |egrep -w
> "(received|delivered|dropped)"
> Thu Mar 22 12:11:34 SAST 2012
>       19969 datagrams received
>       2 dropped due to no socket
>       0 dropped due to full socket buffers
>       19967 delivered
> .
> .
> .
> [root at syslog2~]# date;netstat -p udp -s |egrep -w
> "(received|delivered|dropped)"
> Thu Mar 22 13:36:46 SAST 2012
>       662385 datagrams received
>       118 dropped due to no socket
>       0 dropped due to full socket buffers
>       662267 delivered
> ---
> 
> 
> Somehow this doesn't strike  me as a large volume of throughput …

Ok, fair enough. You might try simulating the problem by deliberately overloading the syslog UDP output and confirm the cause.

- Mark