> It is a single device, single IP, single port, so there is just one socket that is overwhelmed. This will probably be the same failure to process fast enough if we move to a TCP transport.

Yeah, a (single IP, single port) sender won't scale across CPU cores with the default SO_REUSEPORT distribution.

However, 15K msg/sec should be handled without problems.

For example, we've measured 170K msg/sec (70 MB/sec) rates with a single listener using so_rcvbuf(1M) in our performance testing environment.

https://github.com/syslog-ng/syslog-ng/issues/3309#issuecomment-635217670 might be interesting to you.

László Várady