11 Dec
2012
11 Dec
'12
11:52 a.m.
Anton Koldaev <koldaevav@gmail.com> writes:
source s_remote { udp(ip(0.0.0.0) port(514) so_rcvbuf(1024000)); # Switches are configured to send logs here tcp(ip(0.0.0.0) port(5140) max-connections(250) so_rcvbuf(1024000) log_iw_size(20000) so_keepalive(yes) log_fetch_limit(100)); syslog(ip(0.0.0.0) transport("tcp") port(5141) max-connections(200) log_iw_size(20000) flags("threaded") log_fetch_limit(100)); };
The log_iw_size(20000)/max-connections(250) thing is what triggers the error message, by the looks of it. Increasing log_iw_size to 25000 should make the warning go away. The warning could use an update, though, that makes it clearer where it gets the numbers from. -- |8]