Thanks for your reply How can I understand when it's enough to increase things? Is there any manual way to get current values of each buffer, etc? Also since I'm logging a lot of things I'd love to know if there are some other ways to lose messages without seeing them in "dropped"?
In general, performance wise you want to increase stuff (log-fetch-limit, log-iw-size, flush-lines for file destinations), memory-use and reliability wise you want to decrease them. Also, you have to make sure that sum(log-iw-size) < log-fifo-size. So you propose just randomly tune those params? I just don't understand how should I get check if it helped. I need to see the current state of each buffer(to be able to get some statistics data) to see if it helps.
And one more specific question:
If flow-control is in use and one of the destinations cannot accept the messages, the other destinations do not receive any messages either, because syslog-ng stops reading the source. Why there is no messages about it in syslog-ng logs? It must be error, don't you think so? And what if I don't have flow-control enabled?