20 Aug
2008
20 Aug
'08
8:14 p.m.
Hi again, On Wed, Aug 20, 2008 at 12:39 PM, Balazs Scheidler <bazsi@balabit.hu> wrote:
The problem is probably related to the fifo size on the destination file. file related statistics are not reported (as they'd clutter the log statistics message).
so please increase log_fifo_size() on your destination file.
You were right, I was dropping messages on the destination side and increasing the log_fifo_size() there stopped the "dropped messages" warnings. However, it didn't solve the problem. The file on the destination size is still considerably smaller, and it doesn't explain why making the follow_freq() window smaller (from 1s to 50ms) improves the results considerably. Thanks, Joe