Dear Harish,

Could you share your whole config with us?

Regarding UDP performance tuning, you may find further useful information here:
https://www.balabit.com/documents/syslog-ng-pe-6.0-guides/en/syslog-ng-tutorial-udp-source/html-single/index.html

Another useful infomation is that the net.core.rmem_max kernel parameter has to be at least the double of so-rcvbuf() setting. See man 7 socket for further information.

In higher traffic UDP logging scenarios 256 MB for the rmem_max, and 128 MB for so-rcvbuf() might be useful.

Thank you!

Best regards,

János Szigetvári

Janos SZIGETVARI
RHCE, License no. 150-053-692

__@__˚V˚
Make the switch to open (source) applications, protocols, formats now:
- windows -> Linux, iexplore -> Firefox, msoffice -> LibreOffice
- msn -> jabber protocol (Pidgin, Google Talk)
- mp3 -> ogg, wmv -> ogg, jpg -> png, doc/xls/ppt -> odt/ods/odp

2017-07-28 9:10 GMT+02:00 Harish Shetty <harish23shetty@gmail.com>:

Hi

I am using "syslog-ng-3.9.1-1.el6.x86_64" . Few messages are not getting forwarded to destination (Monitoring hosts). But messages are receiving in syslog-ng server from the client.

As a tuning parameter I am using

log_fifo_size (20000);
flush_lines (0);
time_reopen (10);

For source s_tcp , source s_udp and source s_net
so_rcvbuf(8388608)
max-connections(200)
log-iw-size(20000)

Could you please let me know , how we can avoid the messages are not getting forwarded ti destination.

Regards
Harish Shetty

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq