<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Hi there,<br><br>I'm trying to process ~800 UDP messages second, which I don't think is much. The current setup worked fine in Ubuntu 10.04 (Lucid) and syslog-ng 2.6 (I believe). I'm running into what I believe is receive buffer problems on Ubuntu Server 12.04 (Precise) w/ ng 3.XX<br><br>Via tcpdump, I can attest all messages are getting to the server. I'm listening to port 514 UDP. From syslog-ng stats, I don't see any "dropped" statistics (always 0), but I know for a fact that when the message load is more than 150, I start seeing message loss. All messages received are sent to files on local disk after matching some filters. I have tested this with loggen and no filters -- more messages are sent than written to file.<br><br><div align="left">netstat -su shows increasing number of receive errors when going beyond 150 msgs per second. It also shows the receive queue hover in the 20000's. I have tried setting the so_rcvbuf to a relatively large value as described in the admin guide (<em class="parameter"><code>2 097 152</code></em> bytes). The default <em class="parameter"><code>net.core.rmem_max </code></em>on ubuntu server 12.04 is 8388608. I have played with this number, up and down with no luck -- messages are still lost.<br><br>I have spent hours reading documentation, doing packet captures, playing with values in -ng and the host, etc, but I'm at a loss. Any hints as to what I should look into?<br><br>And more direct questions, <br>Will so_rcvbuf declared on the src modify the system's rmem_max or do I have to do it on both? <br>Why is it recommended in the admin guide to not modify the rmem_default?<br><br>Thanks any advice would be helpful.<br><br><br></div> </div></body>
</html>