<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /></head><body style='font-size: 10pt; font-family: Verdana,Geneva,sans-serif'>
<p>Let me add some background:</p>
<div> </div>
<div># cat /etc/redhat-release</div>
<p>Red Hat Enterprise Linux release 9.4 (Plow)</p>
<div> </div>
<div># syslog-ng --version</div>
<div>syslog-ng 3 (3.35.1)<br />Config version: 3.35<br />Installer-Version: 3.35.1<br />Revision:<br />Compile-Date: Feb 6 2023 00:00:00<br />Module-Directory: /usr/lib64/syslog-ng<br />Module-Path: /usr/lib64/syslog-ng<br />Include-Path: /usr/share/syslog-ng/include<br />Available-Modules: xml,add-contextual-data,<wbr />affile,afprog,afsocket,<wbr />afstomp,afuser,appmodel,azure-<wbr />auth-header,basicfuncs,cef,<wbr />confgen,cryptofuncs,csvparser,<wbr />dbparser,disk-buffer,examples,<wbr />graphite,hook-commands,json-<wbr />plugin,kvformat,linux-kmsg-<wbr />format,map-value-pairs,<wbr />pseudofile,regexp-parser,<wbr />sdjournal,secure-logging,<wbr />stardate,syslogformat,system-<wbr />source,tags-parser,tfgetent,<wbr />timestamp<br />Enable-Debug: off<br />Enable-GProf: off<br />Enable-Memtrace: off<br />Enable-IPv6: on<br />Enable-Spoof-Source: on<br />Enable-TCP-Wrapper: off<br />Enable-Linux-Caps: on<br />Enable-Systemd: on</div>
<div> </div>
<div>Extracts from /etc/syslog-ng/syslog-<wbr />ng.conf:</div>
<div> </div>
<div>#### START OF SYSLOG-NG.CONF CONFIGURATION FILE ####<br />@version:3.5<br />@include "scl.conf"<br />options {<br /> flush_lines (100);<br /> time_reopen (10);<br /> log_fifo_size (30000); # Default is 1000<br /> chain_hostnames (off);<br /> use_dns (yes); # This enables IP to hostname translation; this has no effect if keep_hostname() is enabled and message contains a hostname<br /> dns_cache(yes); # DNS caching to improve hostname translation<br /> dns-cache-size(2000); # Default is 1007<br /> dns-cache-expire(14400); # Default is 3600<br /> use_fqdn (yes); # This has no effect if keep_hostname() is enabled and message contains a hostname<br /> create_dirs (yes);<br /> keep_hostname (yes);<br /> threaded (yes);<br />};<br />source s_nas {<br /> network(ip(X.X.X.X) transport(tcp) port(514));<br /> network(ip(X.X.X.X) transport(udp) port(514) so-rcvbuf(26214400));<br /> tcp(ip(X.X.X.X) port(44514) max-connections(300) tls(<br /> key_file("/etc/syslog-ng/key.<wbr />d/priv.key")<br /> cert_file("/etc/syslog-ng/<wbr />cert.d/cert.pem")<br /> peer_verify(optional-<wbr />untrusted))<br /> );</div>
<div> </div>
<div>destination d_nas {<br /> file("/opt/$LOGHOST/logs/nas/$<wbr />R_YEAR-$R_MONTH-$R_DAY/$HOST/$<wbr />YEAR$MONTH$DAY.log"<br /> template(t_splunk)<br /> dir-owner("splunk") dir-group("splunk") dir-perm(0750)<br /> owner("splunk") group("splunk") perm(0640));<br />};</div>
<div> </div>
<div>log { source(s_nas); destination(d_nas); flags(flow-control);};</div>
<div> </div>
<div>Thanks. </div>
<div> </div>
<p> </p>
<p>Il 2025-03-01 08:32 claudio@witel.it ha scritto:</p>
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0"><!-- html ignored --><!-- head ignored --><!-- meta ignored -->
<p>Hello syslog-ng community,<br /><br /> I get this warning at syslog-ng start (or restart) when running journalctl<br /><br /> [...]<br /> Feb 27 02:46:57 xxxsplunksyslog1 syslog-ng[2998304]: [2025-02-27T02:46:57.330923] WARNING: window sizing for tcp sources were changed in syslog-ng 3.3, the configuration value was divided by the value of max-connections(). The result was too small, clamping to value of min_iw_size_per_reader. Ensure you have a proper log_fifo_size setting to avoid message loss.; orig_log_iw_size='3', new_log_iw_size='100', min_iw_size_per_reader='100', min_log_fifo_size='30000'<br /> Feb 27 02:46:57 xxxsplunksyslog1 systemd[1]: Started System Logger Daemon.<br /><br /> I thought the orig_log_iw_size value was coming from the formula log_iw_size/max_connections which should be 100/300=1/3<br /> What is this orig_log_iw_size='3' ?<br /><br /> Thanks.</p>
<!-- html ignored --><br />
<div class="pre" style="margin: 0; padding: 0; font-family: monospace">______________________________________________________________________________<br /> Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br /> Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br /> FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a><br /><br /></div>
</blockquote>
</body></html>