Any suggestions on how I debug this? I have a tcp and a udp source (defined as separate sources) that share a common destination log { souce(s_udp); source(s_tcp); destination(d_file); }; 90% of the log volume comes from the tcp sources. The udp log lines are logged 10 minutes "late". If I decrease the so_rcvbuf then I can get this down to 5-10 seconds "late." I can issue on a source udp server logger -t test "this is a test" and wait on the server. It shows up, but minutes later. OK, playing a little more, if I add the log_iw_size option on the udp source, the symptoms go away. Odd since I do NOT have any flow control in any destination. Can anyone explain why that option would make a difference? Evan. Balazs Scheidler wrote:
that shouldn't be the case, I've never seen anything like this.
----- Original message -----
When I have a udp log source defined with a large so_rcvbuf the upd messages are being delayed.
It seems that the so_rcvbuf needs to fill before the data is read.
Can anyone confirm that the so_rcvbuf needs to fill prior to data being read from the port?
Evan.
______________________________________________________________________________