On Tue, Dec 11, 2012 at 3:52 PM, Gergely Nagy <algernon@balabit.hu> wrote:

Anton Koldaev <koldaevav@gmail.com> writes:

> source s_remote {
> udp(ip(0.0.0.0) port(514) so_rcvbuf(1024000)); # Switches are
> configured to send logs here
> tcp(ip(0.0.0.0) port(5140) max-connections(250) so_rcvbuf(1024000)
> log_iw_size(20000) so_keepalive(yes) log_fetch_limit(100));
> syslog(ip(0.0.0.0) transport("tcp") port(5141) max-connections(200)
> log_iw_size(20000) flags("threaded") log_fetch_limit(100));
> };

The log_iw_size(20000)/max-connections(250) thing is what triggers the
error message, by the looks of it. Increasing log_iw_size to 25000
should make the warning go away.

The warning could use an update, though, that makes it clearer where it
gets the numbers from.

--
|8]

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq

--
Best regards,
Koldaev Anton