Hello list, this morning I had some problems with my syslog system I am adding lots of server to send TCP logs to the syslog-ng server. But there are not on the server.

After readingon the web, I notice that there is a max-connections parameter on the TCP. So I fix to 50. With this there are more logs, then I added 100 and there more.

So I fix it to 1000:

source s_all {

        internal();

        unix-stream("/dev/log");

        file("/proc/kmsg" log_prefix("kernel: "));

        tcp(max-connections(1000));

};

Is this a good idea?

How can I check if this is a good maximum connection value?

Thanks for all your help and best regards.