Hi Every one...

As i am new to this concept,Kindly help on this


All the syslog-ng client forward logs to centralized log server-- works fine.

centralized log server forward logs to tcim server -- works fine for solaris server and other network device--

>From centralized log server to tcim server --  issue ( not collecting logs for linux servers in tcim server )


Centralized log server forward all the logs to tcim server, In Tcim server 4000 devices are configured to collect logs from  centralized log server, However in TCIM sever option for log_fifo_size ( 1000) defined and did not mention any variable as max_conncection. Will this affect logs fails to collect from centralized log to tcim server.


Below options defined in tcim server.

options {
        sync (0);
        time_reopen (10);
        log_fifo_size (1000);
        long_hostnames (off);
#       use_dns (no);
        use_dns (yes);
        use_fqdn (no);
        create_dirs (no);
        keep_hostname (yes);
};

source src {
        udp();
        tcp(port(514) keep-alive(yes));

};



1. If i increase the max-connection(4000 ). do we need to declare below variable  like this...... (User requested  me to define the below value. in tcim server.)

Since i am new to this,  Please advice.

if i declare the below variable, will server get hangs. this is very critical server.

log_fifo_size=4000000
log_iw_size=1000
max-connection(4000)


Thanks in advance.

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.campin.net/syslog-ng/faq.html