syslog and udpInOverflows

From: Matthew SAMS (maclean@cs.mcgill.ca)
Date: Wed Sep 11 2002 - 11:24:08 EDT


Hi,

We have an unusual problem with udpInOverflows on our
syslog server. The counter keeps increasing at a fairly
quick rate. The effect is that we are not receiving very
many of our log messages.

The server is running Solaris 7 with the Recommended
patches from Sept 5. We've moved switch ports, replaced
network patch cables and replaced the hme interface. We've
also blocked the biggest logging host and the problem
continues.

We've also increased udp_rcv_hiwat and udp_max_buf with
no effect.

The syslog server receives about 53 requests per second
as measured via snoop.

The udpInOverflows increases at about 100 counts per second.
udpNoPorts increases count maybe once per 30 minutes.

The server is incredibly idle. Running 'truss -f' on syslogd
shows minimal activity.

Any suggestions for further debugging?

-Matthew
_______________________________________________
sunmanagers mailing list
sunmanagers@sunmanagers.org
http://www.sunmanagers.org/mailman/listinfo/sunmanagers



This archive was generated by hypermail 2.1.7 : Wed Apr 09 2008 - 23:24:55 EDT