<html><head></head><body>Hi Jim,<br>
<br>
While not a direct answer and following on from Fabien's suggestion:<br>
<br>
If in a virtual environment, as a work around you could create a few instances running syslog-ng with udp source and tcp destinations, and enable fifo or disk buffering and balance the load over the new instances; maybe explore round robin dns configuration if your environment permits?<br>
<br>
Kr,<br>
<br>
James<br><br><div class="gmail_quote">On 11 January 2017 08:26:39 GMT+00:00, Fabien Wernli <wernli@in2p3.fr> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail">Hi Jim,<br /><br />On Tue, Jan 10, 2017 at 04:20:02PM -0500, Jim Hendrick wrote:<br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> loss rate. (according to netstat -su | grep error).<br /></blockquote>[…]<br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> On the syslog-ng side syslog-ng-ctl stats shows *no* drops at all.<br /></blockquote><br />This means that syslog-ng isn't accepting the packets fast enough, so the<br />kernel starts buffering, and the latter gets full, thus increasing the<br />kernel counters (see `/proc/net/snmp`).<br /><br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> Increasing net.core.rmem_max and so_rcvbuf together all the way to 64 MB<br /> did not seem to make any significant difference.<br /></blockquote><br />I'm afraid these are the values I was going to suggest.<br /><br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> This is a RHEL 6 box with 16 GB and 4 cores (virtual - running in an ESX<br /> environment)<br /></blockquote><br />FWIW I've had many problems with dropped Udp on virtual machines. It's easy<br />to correlate the `steal` cpu state with drop events where relevant.<br /><br /><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> Are there other parameters, things I should be looking at?<br /></blockquote><br />I'm curious too if there is anything else that can be done (apart from<br />switching to TCP).<br /><br /><hr /><br />Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br />Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br />FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a><br /><br /></pre></blockquote></div><br>
-- <br>
Sent from my Android device with K-9 Mail. Please excuse my brevity.</body></html>