Hi, You dont need to bother with log-fetch-limit() as that parameter is there to avoid starvation if a connection is continuously sending messages without a pause. This is needed as a single thread handles multiple connections and if one sends messages continuously the rest wouldnt get a chance. If all input connections send a single message then I wouldnt bother with so-rcvbuf either. And not with TCP anyway. You might want to increase max-connections though to accept potential peaks. Sending one message per TCP connection is not really ideal performance wise though, 250 msg/sec is not much if connections are kept alive. Isn't running syslog-ng or something else on the client feasible? One that would keep the connection for longer term? On Nov 20, 2015 4:48 AM, "Al Itchon" <AItchon@boardreader.com> wrote:
I have about 1000 servers sending tcp messages through a call to /dev/tcp to a port on my syslog-ng server. I’m assuming each call to /dev/tcp is a single connection and a single message, so am I correct that the log_fetch_limit should be set to 1 since it applies to each connection?
Also, should I bother adjusting the so-rcvbuf? I know the manual mentions that if using UDP, the receive buffer should be increased. I’m using TCP and my message rate is about 250 messages/sec.
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq