Hello Guys, Here's an update on my investigation (still using latest 1.9.9 snapshot on Solaris 8): - I have proof (snoop/tcpdump) that all sent packets indeed arrive at the network interface of my syslog server - I have validated, using a simple while { recvfrom; printf } loop that all udp packets CAN go through the network layer with the default system buffer settings without any packet loss. - By adding a debugging mesage right after the recvfrom call in syslog-ng (in fd_do_read), I can validate that no message that is received that way is lost within syslog-ng. However I still observe a loss of messages. - I do not see a significant increase in udpInOverflows during the tests. Even though through the day, this value may increase of a few units. Default buffer settings are: ndd /dev/udp udp_recv_hiwat 65536 ndd /dev/udp udp_max_buf 1048576 Meaning that the default socket buffer size is 64k. IT CANNOT BE INCREASED FURTHER UP. I thus decided to the following code: ---- int rcvbuflen=1048576; setsockopt(sock, SOL_SOCKET, SO_RCVBUF, &rcvbuflen, sizeof(rcvbuflen)); ---- in g_sockaddr_inet_bind_prepare which apparently solved my problem or at least allowed my test to pass. This does not guarantee that when the traffic increases further up for any reason, I will not jump once again to the limit of the socket buffer. I still have one problem though: why didn't the packet show up in udpInOverflow when they should have ? I'll keep you updated when I find out. Also I'll try to provide a patch for the setsockop stuff but not being a good developper it might be better if one of you official syslog-ng team member took it from here. Keep up the good work... Vincent. -- .~. Vincent Haverlant -- Galadril -- #ICQ: 35695155 /V\ MSN: vincent_msn@haverlant.org -- http://www.haverlant.org/ /( )\ Parinux member: http://www.parinux.org/ ^^-^^ GPG: 8FEA 52C2 5C54 A201 2375 0FA5 AF2E 1881 92D0 EE84