5 Nov
2014
5 Nov
'14
3:23 p.m.
We have lots of traffic going through syslog-ng in our system (5000 logs per second), so some logs are dropped because of 'log_fifo_size()'. I've look around the web and found flush-lines and flush-timeout methods, but also it failed in every configuration. Related parts of my syslog-ng conf looks like that at the moment. " log_fifo_size(4096); flush_lines(100); flush_timeout(1000); " If I increase fifo size to ~ 16000 ,syslog-ng consumes too much memory for my system to operate. Is there any other way to stop that leak and what is the best practice to use? Thanks in advance. -Yalin