You probably need to restart syslog-ng for a buffer size to take effect, and you also have to make sure to change the correct knobs. There are two things to take into consideration. 1) throughput 2) latency If the throughput is higher than what syslog-ng handles with the specific config, buffer sizes will not help. If syslog-ng is generally able to cope with the load, one has to make sure that the input buffer size of a socket is large enough to keep incoming traffic between syslog-ng starting the poll on the socket vs it actually starts reading messages. Also, syslog-ng may be forced to stop reading it's input if the destination blocks/slow. Back to how long it takes for tuning to take effect: after a restart, immediately if the load is the same. Bazsi On Jun 23, 2017 8:58 PM, "Jim Hendrick" <james.r.hendrick@gmail.com> wrote:
Hi all,
What are your experiences with tuning the kernel for UDP, TCP, etc.
How long does it take to see results from a single change?
We are working issues with UDP drops, and have made fairly radical increases in buffer sizes with no apparent improvement, only to re-visit the system in a few days and seeing it cleaned up.
"intuitively" I have always thought it should happen right away - but that is not what we are seeing here now.
Thoughts?
Thanks in advance!
Jim
____________________________________________________________ __________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/? product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq