Fri, 23 Oct 2009 10:13:35 -0400 On Friday 23 October 2009, Edward Capriolo wrote: > On Fri, Oct 23, 2009 at 6:58 AM, Chuck <chuck@sbbsnet.net> wrote: > > On Friday 23 October 2009, Konrad Korzeniowski wrote: > >> Hi, > >> > >> I don't know syslog-ng, but there is rsyslog solution: > >> http://www.rsyslog.com/doc-rsyslog reliable forwarding.html > >> > > > > thanks. i will look into it. > > > >> rgrds., > >> KK > >> > >> [2009-10-23 04:16] Chuck: > >> > I doubt this is a vserver problem, but I am placing this here just in > > case > >> > there may be something. > >> > > >> > we run a remote logging server that every host and guest logs to in > > addition > >> > to local logs. when all is well this works just fine. > >> > > >> > if the remote log server is taken down, suddenly most of the hosts begin > >> > chewing up all available memory and swap until they crash. disabling > > remote > >> > logging on everything cured this but obviously is not what we want. > >> > > >> > i am also posting this in the gentoo forum in case it is a syslog-ng or > > other > >> > issue. > >> > > >> > we use 2 lines in every syslog-ng config.. obviously the ip is changed for > >> > public viewing: > >> > > >> > destination remote { udp("1.3.0.1"); }; > >> > log { source(src); destination(remote); }; > >> > > >> > on all machines > >> > kernel is > >> > > >> > 2.6.26-vs2.3.0.35.6-gentoo > >> > > >> > util-vserver is 0.30.215 > >> > > >> > > >> > > >> > >> > > > > > > > > -- > > > > Chuck > > > > Chuck, > > Strange, since UDP packets have no guarantees for transmission or > delivery one would imagine they would be sent and dropped. Maybe > syslog-ng has a delivery queue that that holds messages until it can > make a connection to the remote server and since your server is down > the messages build up. > after reading about the rsyslog that suddenly occurred to me too... i am going to look into the options available for the config to see if there is a queue and if so maybe it can be disabled. i always thought udp was 'blind' and that syslog-ng would just blindly send out and if it reached the destination fine if not it would not know the difference and continue on.. evidently not.. > Edward > -- Chuck