Actually, you did not say it in your message. Because searching it for the string 'buf' returns no results.
Look, I'm not trying to be difficult, but I do at least expect people to read my email before responding. Here, I'll quote it for you: If I raise the rmem settings like this: net.core.rmem_default = 512000 net.core.rmem_max = 1024000 Then it looks like I can support messages rates around 1000 msgs/sec. If I try with 2000 msgs/sec, the loss rates jumps up again (to around 30%). I'm sorry if you got bored before reading it. I was trying to provide sufficient details that people wouldn't suggest the things I've already tried. Additionally, as far as I can tell, setting net.core.rmem_default is largely equivalent, from the point of view of syslog-ng, to setting so_rcvbuf() (since it sets the default receive buffer size). On a system with lots of open sockets, setting a lower net.core.rmem_default and using so_rcvbuf() would probably make more sense.