Re: lost events on boot

> The kernel is supplying the serial number (right?), so is it > discarding the events without assigning a serial number? Yes, the kernel assigns the serial numbers. Sometimes. Some buffers never get allocated and therefore no serial number assigned due to full queues or memory pressure. Other buffers get dropped when queues are full and there is no choice but to drop a message. This is true before and after Paul's queue re-write. > * Do I have something wrong with my kernel boot parameters? Not likely. From what you have described above it sounds like you have done what you can. > I'd have thought that 8k buffers would be enough, and certainly if I only > have 515 events, should be. Unless, each record inside the event is adding. If your kernel command line is larger than your lost count and your serial number when you check it after boot, you should be in good shape. > I also then counted each record, not just events, and got around 1600, so > I'd have thought that even multi-record events would have fit. I guess that > depends on the buffer size. Good thinking, and you are correct. That backlog limit may need to be increased for more recent kernels since there are more events caught and some events have more records. > Appreciate the help in advance; thanks. I hope this helps.