Thanks for your reply<div>How can I understand when it's enough to increase things? Is there any manual way to get current values of each buffer, etc?</div><div>Also since I'm logging a lot of things I'd love to know if there are some other ways to lose messages without seeing them in "dropped"?</div>
<div><br></div><div><span style="font-family:arial,sans-serif;font-size:13px">> In general, performance wise you want to increase stuff (log-fetch-limit, log-iw-size, flush-lines for file destinations), memory-use and reliability wise you want to decrease them. </span><br style="font-family:arial,sans-serif;font-size:13px">
<span style="font-family:arial,sans-serif;font-size:13px">> Also, you have to make sure that sum(log-iw-size) < log-fifo-size.</span><br></div><div>So you propose just randomly tune those params? I just don't understand how should I get check if it helped. I need to see the current state of each buffer(to be able to get some statistics data) to see if it helps.</div>
<div><br></div><div>And one more specific question:<br></div><div>> <span style="color:rgb(0,0,0);font-family:Arial,Helvetica,sans-serif;font-size:12px;line-height:14px;text-align:justify">If flow-control is in use and one of the destinations cannot accept the messages, the other destinations do not receive any messages either, because syslog-ng stops reading the source.</span></div>
<div style="text-align:justify"><font color="#000000" face="Arial, Helvetica, sans-serif"><span style="font-size:12px;line-height:14px">Why there is no messages about it in syslog-ng logs? It must be error, don't you think so?</span></font></div>
<div style="text-align:justify"><font color="#000000" face="Arial, Helvetica, sans-serif"><span style="font-size:12px;line-height:14px">And what if I don't have flow-control enabled?</span></font></div>