[syslog-ng] WARNING: window sizing for tcp sources

[Anton Koldaev]

> --preprocess-into only tells syslog-ng to write the processed config to
> a file, it will then proceed to do whatever else it would've done
> without the option. That's a bit counter-intuitive, I agree. You can use
> the --syntax-only (-s) option to just write the file and exit without
> doing anything else.

Got it, thanks!

> Can you show your global settings, by any chance? Also, what @version does
your syslog-ng.conf have?
> (This is most likely in your global settings)
# Global:
options {
    threaded (yes);
    time_reopen (10);
    chain_hostnames (off);
    use_dns (yes);
    dns_cache (yes);
    dns_cache_size (2000);
    dns_cache_expire (86400);
    use_fqdn (no);
    keep_hostname (yes);
    stats_freq (0);
    stats_level (1);
    log_msg_size (16384);
    log_fifo_size (8000000);
};

# Version:
@version: 3.3

# Sources
source s_local {
    file ("/proc/kmsg" program_override("kernel: "));
    unix-stream ("/dev/log");
};

source s_local_internal {
    internal();
};

source s_remote {
    udp(ip(0.0.0.0) port(514) so_rcvbuf(1024000)); # Switches are
configured to send logs here
    tcp(ip(0.0.0.0) port(5140) max-connections(250) so_rcvbuf(1024000)
log_iw_size(20000) so_keepalive(yes) log_fetch_limit(100));
    syslog(ip(0.0.0.0) transport("tcp") port(5141) max-connections(200)
log_iw_size(20000) flags("threaded") log_fetch_limit(100));
};

# TCP and UDP source for each app
<% @apps.each do |app| %>
source s_remote_<%= app[:id] %> {
    syslog(ip(0.0.0.0) transport("tcp") port(<%= app[:syslog][:port] %>)
max-connections(100) log_iw_size(20000) flags("threaded")
log_fetch_limit(100));
};
source s_remote_udp_<%= app[:id] %> {
    udp(ip(0.0.0.0) port(<%= app[:syslog][:udp_port] so_rcvbuf(1024000)); #
HAproxy
};
<% end %>






On Tue, Dec 11, 2012 at 12:28 AM, Gergely Nagy <algernon at balabit.hu> wrote:

> --preprocess-into only tells syslog-ng to write the processed config to
> a file, it will then proceed to do whatever else it would've done
> without the option. That's a bit counter-intuitive, I agree. You can use
> the --syntax-only (-s) option to just write the file and exit without
> doing anything else.
>



-- 
Best regards,
Koldaev Anton
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20121211/0a1b15e2/attachment.htm