Server syslog-ng Did Not Receive Some Alarm Notifications
Symptom
A large number of alarms were reported in a storage system. However, server syslog-ng did not receive some alarm notifications. The netstat -su | sed -n '/Udp:/,+6p' command is executed on server syslog-ng to check whether UDP data packet loss occurs.
If the value in the red square increases, the UDP data packet loss occurs.
Possible Causes
The processing capabilities of server syslog-ng are limited and the UDP cache is insufficient. You must modify the cache size of the server.
Procedure
- Run the sysctl -a | grep net.core and sysctl -a | grep udp commands on the server to check the UDP cache size.
- Run the sysctl -w command on the server to set the UDP cache size to a larger value.
- Run the sysctl -p command to enable the UDP cache configuration to take effect.
- Run the sysctl -a| grepnet.core and sysctl -a |grep udp commands on the server to check the UDP cache size after the modification.
- Run the service syslog restart command to restart the syslog service.