You're right. Thanks On Tue, Dec 11, 2012 at 3:52 PM, Gergely Nagy <algernon@balabit.hu> wrote:
Anton Koldaev <koldaevav@gmail.com> writes:
source s_remote { udp(ip(0.0.0.0) port(514) so_rcvbuf(1024000)); # Switches are configured to send logs here tcp(ip(0.0.0.0) port(5140) max-connections(250) so_rcvbuf(1024000) log_iw_size(20000) so_keepalive(yes) log_fetch_limit(100)); syslog(ip(0.0.0.0) transport("tcp") port(5141) max-connections(200) log_iw_size(20000) flags("threaded") log_fetch_limit(100)); };
The log_iw_size(20000)/max-connections(250) thing is what triggers the error message, by the looks of it. Increasing log_iw_size to 25000 should make the warning go away.
The warning could use an update, though, that makes it clearer where it gets the numbers from.
-- |8]
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
-- Best regards, Koldaev Anton