On Wed, 2003-12-10 at 17:54, Josh Endries wrote:
Hey all,
We log 20ish hosts to a central log server (many are through stunnel) and recently I started getting dropped messages. I see anywhere from 1-10 dropped per STATS line. This probably has something to do with us installing iplog on some machines and increasing the traffic (only timely coincidence I can think of) I'm wondering what, if anything, can be done to help the situation.
I've read that you can increase the log_fifo_size to help with this problem, but I'm not sure what the default value is or what I should set it to. Is there a guideline for what to set this for X number of machines, or for a certain amount of traffic?
log_fifo_size specifies the number of log lines a given destination can temporarily hold before starting to drop messages. The default value is 100 and you could increase this number at will. Please note however that syslog-ng will not enforce flow control, that is it will not limit incoming message rate if it is not able to send messages at the smae speed. If you only have a couple of bursts but the overall message rate stays below the processing limits of your central server then log_fifo_size will help. Otherwise you will have to increase server/network capacities. -- Bazsi