Subject: Re: [vserver] all memory consumed
From: Edward Capriolo <edlinuxguru@gmail.com>
Date: Fri, 23 Oct 2009 09:51:19 -0400

 Fri, 23 Oct 2009 09:51:19 -0400
On Fri, Oct 23, 2009 at 6:58 AM, Chuck <chuck@sbbsnet.net> wrote:
> On Friday 23 October 2009, Konrad Korzeniowski wrote:
>> Hi,
>>
>> I don't know syslog-ng,  but there is rsyslog solution:
>> http://www.rsyslog.com/doc-rsyslog reliable forwarding.html
>>
>
> thanks. i will look into it.
>
>> rgrds.,
>> KK
>>
>> [2009-10-23 04:16] Chuck:
>> > I  doubt this is a vserver problem, but I am placing this here just in
> case
>> > there may be something.
>> >
>> > we run a remote logging server that every host and guest logs to in
> addition
>> > to local logs. when all is well this works just fine.
>> >
>> > if the remote log server is taken down, suddenly most of the hosts begin
>> > chewing up all available memory and swap until they crash. disabling
> remote
>> > logging on everything cured this but obviously is not what we want.
>> >
>> > i am also posting this in the gentoo forum in case it is a syslog-ng or
> other
>> > issue.
>> >
>> > we use 2 lines in every syslog-ng config.. obviously the ip is changed for
>> > public viewing:
>> >
>> > destination remote { udp("1.3.0.1"); };
>> > log { source(src); destination(remote); };
>> >
>> > on all machines
>> > kernel is
>> >
>> > 2.6.26-vs2.3.0.35.6-gentoo
>> >
>> > util-vserver is 0.30.215
>> >
>> >
>> >
>>
>>
>
>
>
> --
>
> Chuck
>

Chuck,

Strange, since UDP packets have no guarantees for transmission or
delivery one would imagine they would be sent and dropped. Maybe
syslog-ng has a delivery queue that that holds messages until it can
make a connection to the remote server and since your server is down
the messages build up.

Edward