Re: Snmptrapd losing traps when configured to log via syslog
Bart Van Assche <[email protected]>
| Newsgroups | gmane.network.net-snmp.user |
|---|---|
| Message-ID | <[email protected]> |
On Wed, Jan 20, 2010 at 4:02 PM, <[email protected]> wrote: > I am using snmptrapd in order to forward traps to another listening > application. > I have tested performance by storming *multiple traps per second*, using a > trap stormer tool > Net-SNMP version used : 5.3.2.2-5 > Platform tested : Linux > snmptrapd startup options : -Lsd > > It is noticed that snmptrapd did not log all traps to /var/log/messages, as > an example, for 500 traps, it logged details of only 371 traps. > Hence, the other listening application also showed that it received 371 > traps. > However, when snmptrapd is restarted with options to log to a file i.e, -Lf > <filename>, for the same testing, NO trap loss was seen. > > *I would like help in understanding the reason why logging via syslog is > leading to trap loss, to be precise the difference in the logging methods > used by snmptrapd for syslog and normal file logging, which could cause trap > loss when logging via syslog. Please help.* > > Also, when snmptrapd is configured to forward as well as invoke traphandler > for each trap, even with options to log to file, traps are getting dropped. > > Is there some information of performance constraints for snmptrapd in terms > of trap loss? > Since snmptrapd is single-threaded, it can log at most 1 / (time in seconds needed to log a single trap) traps per second. Higher trap rates will cause trap loss. The above means that at least on your setup logging via syslog takes more time than logging to a file. Bart. ------------------------------------------------------------------------------ Throughout its 18-year history, RSA Conference consistently attracts the world's best and brightest in the field, creating opportunities for Conference attendees to learn about information security's most important issues through interactions with peers, luminaries and emerging and established companies. http://p.sf.net/sfu/rsaconf-dev2dev _______________________________________________ Net-snmp-users mailing list [email protected] Please see the following page to unsubscribe or change other options: https://lists.sourceforge.net/lists/listinfo/net-snmp-users