You're right. Thanks<div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Dec 11, 2012 at 3:52 PM, Gergely Nagy <span dir="ltr"><<a href="mailto:algernon@balabit.hu" target="_blank">algernon@balabit.hu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">Anton Koldaev <<a href="mailto:koldaevav@gmail.com">koldaevav@gmail.com</a>> writes:<br>
<br>
> source s_remote {<br>
> udp(ip(0.0.0.0) port(514) so_rcvbuf(1024000)); # Switches are<br>
> configured to send logs here<br>
> tcp(ip(0.0.0.0) port(5140) max-connections(250) so_rcvbuf(1024000)<br>
> log_iw_size(20000) so_keepalive(yes) log_fetch_limit(100));<br>
> syslog(ip(0.0.0.0) transport("tcp") port(5141) max-connections(200)<br>
> log_iw_size(20000) flags("threaded") log_fetch_limit(100));<br>
> };<br>
<br>
</div>The log_iw_size(20000)/max-connections(250) thing is what triggers the<br>
error message, by the looks of it. Increasing log_iw_size to 25000<br>
should make the warning go away.<br>
<br>
The warning could use an update, though, that makes it clearer where it<br>
gets the numbers from.<br>
<div class="HOEnZb"><div class="h5"><br>
--<br>
|8]<br>
<br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br>Best regards,<br>Koldaev Anton<br>
</div>