I have about 1000 servers sending tcp messages through a call to /dev/tcp to a port on my syslog-ng server. I’m assuming each call to /dev/tcp is a single connection and a single message, so am I correct that the log_fetch_limit should
be set to 1 since it applies to each connection?
Also, should I bother adjusting the so-rcvbuf? I know the manual mentions that if using UDP, the receive buffer should be increased. I’m using TCP and my message rate is about 250 messages/sec.