Fri, 23 Oct 2009 09:51:19 -0400 On Fri, Oct 23, 2009 at 6:58 AM, Chuck <chuck@sbbsnet.net> wrote: > On Friday 23 October 2009, Konrad Korzeniowski wrote: >> Hi, >> >> I don't know syslog-ng, but there is rsyslog solution: >> http://www.rsyslog.com/doc-rsyslog reliable forwarding.html >> > > thanks. i will look into it. > >> rgrds., >> KK >> >> [2009-10-23 04:16] Chuck: >> > I doubt this is a vserver problem, but I am placing this here just in > case >> > there may be something. >> > >> > we run a remote logging server that every host and guest logs to in > addition >> > to local logs. when all is well this works just fine. >> > >> > if the remote log server is taken down, suddenly most of the hosts begin >> > chewing up all available memory and swap until they crash. disabling > remote >> > logging on everything cured this but obviously is not what we want. >> > >> > i am also posting this in the gentoo forum in case it is a syslog-ng or > other >> > issue. >> > >> > we use 2 lines in every syslog-ng config.. obviously the ip is changed for >> > public viewing: >> > >> > destination remote { udp("1.3.0.1"); }; >> > log { source(src); destination(remote); }; >> > >> > on all machines >> > kernel is >> > >> > 2.6.26-vs2.3.0.35.6-gentoo >> > >> > util-vserver is 0.30.215 >> > >> > >> > >> >> > > > > -- > > Chuck > Chuck, Strange, since UDP packets have no guarantees for transmission or delivery one would imagine they would be sent and dropped. Maybe syslog-ng has a delivery queue that that holds messages until it can make a connection to the remote server and since your server is down the messages build up. Edward