[systemd-devel] Forwarding to syslog missed XX messages

[Lennart Poettering]

On Mon, 15.09.14 13:20, Reindl Harald (h.reindl at thelounge.net) wrote:

> anybody an idea why?
> 
> Sep 15 13:14:43 localhost systemd-journal[4650]: Forwarding to syslog missed 2 messages.
> Sep 15 13:15:13 localhost systemd-journal[4650]: Forwarding to syslog missed 196 messages.
> Sep 15 13:15:44 localhost systemd-journal[4650]: Forwarding to syslog missed 236 messages.
> Sep 15 13:16:14 localhost systemd-journal[4650]: Forwarding to syslog missed 180 messages.
> Sep 15 13:16:44 localhost systemd-journal[4650]: Forwarding to syslog missed 323 messages.
> Sep 15 13:17:15 localhost systemd-journal[4650]: Forwarding to syslog missed 232 messages.
> Sep 15 13:17:45 localhost systemd-journal[4650]: Forwarding to syslog missed 156 messages.

Apparently syslog forwarding is on but your syslog implementation is
not capable of keeping up processing the messages quickly enough. Note
that by default the number of messages that may be queued in the
syslog socket is relatively low, you can bump it via
/proc/sys/net/unix/max_dgram_qlen, which would allow more messages to
be queued so that your syslog implementation has more time to process
the messages.

Why precisely your syslog implementation is too slow is something
you'd have to debug on the side of theat implementation, we cannot
determine this from systemd's side.

Note that rsyslog doesn't need the syslog forwarding anymore these
days, it picks up the messages directly from the journal. You can thus
turn syslog forwarding off with ForwardToSyslog=no in
journald.conf. In fact, very recent systemd versions actually changed
the default here to off, given the fact that rsyslog doesn't need this
any more.

Lennart

-- 
Lennart Poettering, Red Hat