options {

flush_lines (1000);

time_reopen (10);

log_fifo_size (1000);

long_hostnames (off);

use_dns (no);

use_fqdn (no);

create_dirs (yes);

keep_hostname (yes);

keep_timestamp(yes);

dir_group("syslog");

perm(0640);

dir_perm(0750);

group("syslog");

};

I have already set TCP kernel buffers to 128MB max and set disk scheduler to "deadline".

But even under light disk IO load, from ~8-25MB, I see "1320811067 packets collapsed in receive queue due to low socket buffer". I had some other processes on the host writing to disk. Stopping them reduced the packet errors but this number still keeps incrementing.

To rule out other issues, I temporarily pointed my disk-based destinations to /dev/null and then packet losses/errors stopped. So either Syslog-NG isn't able to write to disk fast enough or there is an underlying OS/hardware issue.

Both hosts have the same issue. Any pointers in troubleshooting it will be appreciated.

TIA.