MonitorWare Knowledge Base

Would it be possible for you to forward the previous responses to my work e-mail (smparcel@aep.com) and copy my personal e-mail (seanparcel@yahoo.com) on the response? I would like to monitor the SPAM blocker to see if it is killing the messages.

sparcel wrote:Would it be possible for you to forward the previous responses to my work e-mail (smparcel@aep.com) and copy my personal e-mail (seanparcel@yahoo.com) on the response? I would like to monitor the SPAM blocker to see if it is killing the messages.

I have implemented this into our ticket system. Did you get the notification email?

Best regards,
Michael Meckelein
Adiscon

I received the copy that went to Yahoo, but not the copy destined for my work e-mail. I have opened a case on that issue with our Messaging team.

Hi,

Edit: Changed Email back to original. I missed that our support team added another hotfix for this issue

regards,
Andre

Our messaging team is "white-listing" the adiscon.com e-mail domain o prevent any future messages from being blocked. You can cnahge the address back to smparcel@aep.com if it is not set to this already. Thanks.

hallo @ all,

we have the same problem. Although in our testlab where only few servers are connected to WinSyslog, this messages appears in the eventlog.
In the production-system they appears with an rate up to 10 messages/minute. More than this ... app. 1000 times our webserver notify to us that the WinSyslogServer reset the connection.

But apart from sparcel i don't see that the WinSyslog stops the logging for an hour. It seems to log the messages although the Winsyslog reports the 114-error. (may be i failed to see the gaps).

The last messages of this thread is some days old. Are there any new facts or may be even a solution??? I'm a little bit nervous due to this problem ;o)

regards
Ilona

I am currently running the rolling beta code (6.2 Build 423) on one of our syslog servers. In our environment we were experiencing message spikes during peak hours that were generating over 3,000 messages per second from several network devices. When these spikes lasted long enough the message queue would begin filling and eventually the server ran out of memory for the winsyslg.exe service. Setting the queue limit to 200,000 messages seemed to help the service from crashing but then we were missing messages during the spikes. The beta version I am now using is supposed to do some output filename caching that should help the performance.

Hi Ilona,

I think I remember you from previous conversation Please let me know which version you currently use and on which hardware. We are very eager to provide the best possible performance and to capture as many messages as possible. We are currently working on some optimizations for hyperthreading, but this work is also related in a more general sense. In short: I would like to gain as much feedback as possible to see where we might have an issue. I am absolutely positive we can resolve these things, at least as long as the hardware ressources are sufficient.

As some advise from the current case, I'd recommend to set the queue limit to about 400,000 to 500,000 messages. That should work well on a machine with at least 2GB of RAM.

I also recommend that you take a look at the rolling beta, it already has some optimizations, memory-shortage reporting (be sure to enable warnings in general properties and there is much more to come. Performance once again is the focus of the next release.

Looking forward to feedback,
Rainer

Hello Rainer,
nice to "see" you again

In our testlab we are running 6.14.20 and in production-system 5.3.374. Actual we plan to rollout the 6.14.20-version not later than kw48. If the current tests runs well, i will make a live-production-test at next week (probably starting at wednesday night).

The production-machines are 3 GHz Xeon (4CPU) with 2 GB RAM (OS= W2k Server). The testmachine is a 1,3 GHz PentiumIII (2 CPU) with 4 GB RAM (OS= W2003 Server).
Actually the production-machines have an load up to ~22000 Messages/min. Every 90 minutes one of our applications sends additionally ap. 30000 Messages per minute and for each server for ~ 5 min. These application ist my big "Sorgenkind". Due to this application yesterday i make the decision to use the ability of WinSyslog to send the messages over one TCP-connection in contrast to making a new connection for each message.

I follows your recommendation and set the queue limit both at production and at test to 500000. On production-system it seems to have no effect. On test i musst wait until tomorrow because our test-team early goes home

Regarding the consumption of memory we have absolutly no problems. I just now checks the memory values over the last 12 month and Winsyslog5.3 never takes more than 50 MB. The 6.2-Version shows the same low memory consumption, but to date we havn't run a big loadtest (only same small load-tests). If i roll out the new version next week i will see if the new version takes more memory than the old one.

May be i can scare up additional test-machine in order to test the rolling beta. For now we are testing a bigger software release and my test-team is very touchy regarding to every change in our testlab

If i can help you in some way (logfiles etc) to investigate the appearance of 114-error, let me know.

with kind regards,
Ilona

Ilona,

if the memory consumption does not go up, I think we must be dealing with something different here. Unfortunately, the 114 error is an infamous one. In the "dark ages", this ID was used for almost everything. So the id itself does not have any meaning, you need to look at the message text (of course, we are working on removing this 114 ambiguity, but some things stay for a long time...).

If you could turn on debug logging and forward me a copy, I could probably check for the exact reason - or at least ask some other questions.

Oh, yes... Does the memory consumption not go up even during the spikes? That would actually surprise me a little...

Rainer

Rainer,
i agree with you that the 114-error-messages in fact is a very nebulous message.
The content of our messages is allways the same: "Unknown error while applying the actions - continuing". Due to the fact that the error-message not implicit means a loss of original message i'm thinking that the error is very annoying, but not so critical (or am i in error?).

The message from our webserver regarding the connection resets by the Winsyslog is for me an more serious problem because its definitivly indicate a loss of original messages. Unfortunately the error generated by java is also a more or less vague: "java.net.SocketException: Connection reset by peer: socket write error " . In the sun-docs the only explanation is the following: "Thrown to indicate that there is an error in the underlying protocol, such as a TCP error" :-/

The memory consumption isn't go up even there are spikes (may be there is an short raising over severals seconds... but i don't see this because our measurement runs every 2 minutes). Some other thing is the CPU-load. This goes up during the spikes from ~15% to ~42%.

I will send you an debug-logging per email. I make it today on the testsystem (i think you not really want a log from our live-system ). It's not very big and during the collection several times occures the 114error: 8 times at 12:15:15 and 3 times at 12:15:16. Please don't wonder... as this is a testsystem there are some rules which possibly look a little bit strange for you

Regards,
Ilona

Just a quick information: the error message is so "nebulous" not because we try to hide something but because we have no better information. The message is generated by a high-level exception handler, which is NOT expected to be executed. In any case, we do not get any more specific information ourselfs, what makes it hard to reveal the cause.

I've also had a quick look at the log you send (thanks!), but it does not really clear up the situation. I will keep you posted.

Rainer