On Fri, 2009-12-11 at 18:32 +0530, Paras Fadte wrote:

Hi,

When logging to a remote syslog server , I see a lot of udp "packet receive errors" on the remote syslog server . The source machines don't show any such packet loss. I tried increasing net.core.wmem_max to 16MB and changed the log_fifo_size value to 2000 from default 100 on remote syslog server but still I continue to see udp packet receive errors . What could be the issue here ? The incoming request rate is inorder of 50k/sec during peak time. What can be done to minimize these errors?

Syslog-ng version is syslog-ng 1.6.8

you should increase the _receive_ buffer size of the server, not tune the client. you can generally tune this stuff via /proc/sys/net and recent syslog-ng's even have some syslog-ng.conf knobs to do the same. just look for so_rcvbuf() options, but please note that kernels may limit this value even if the application requests larger sizes. See "man 7 socket", and search for /proc/sys/net/core/rmem_default and /proc/sys/net/core/rmem_max -- Bazsi