On 07/23/10 12:10, Paul Robertson wrote:
Our application calls syslog(3c) to write to the local syslog daemon, and we were puzzled when some messages weren't appearing in the local /var/adm/messages file. We wrote a test program to spew 60000 unique messages, and confirmed that not all syslog calls result in corresponding entries in /var/adm/messages.
See uts/common/io/log.c for the underlying log driver. It uses log_sendmsg to put messages on the log queue. That is a streams device with a hiwater setting of LOG_HIWAT: #define LOG_MID 44 /* module ID */ #define LOG_MINPS 0 /* min packet size */ #define LOG_MAXPS 1024 /* max packet size */ #define LOG_LOWAT 2048 /* threshold for backenable */ #define LOG_HIWAT 1048576 /* threshold for tossing messages */ When the stream has more the LOG_HIWAT (a whole 1M) then it will stop accepting new putq until the stream drains a bit. Essentially all that is to guard against excessive kernel memory use - if it was unbounded then an unprivileged script calling logger(1) could use lots of kernel memory, for instance. I suspect 1M is a little on the tight side these days. That said, syslog was never really designed/intended to accept a very large message rate. Gavin _______________________________________________ opensolaris-code mailing list opensolaris-code@opensolaris.org http://mail.opensolaris.org/mailman/listinfo/opensolaris-code
