Is there a way to increase this buffer ? On Tue, Oct 7, 2008 at 8:25 AM, Geller, Sandor (IT) < Sandor.Geller@morganstanley.com> wrote:

Hello,

...

I'm experiencing packet losses with syslog-ng, I know that there's some tweak that can be done to kernel to handle a bigger buffer...

Anyone could tell me what can I tweak with sysctl so it will stop dropping ?

syslog-ng has the so_rcvbuf and so_sndbuf options, so there is no need to change system-wide settings.

Regards,

Sandor --------------------------------------------------------

NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.

______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html

-- ------- Francis Lacoste-Cordeau

On Tue, 2008-10-07 at 09:42 -0400, Francis Lacoste wrote:

Found my answer: You can tweak it by specifing so_rcvbuf(...); in tcp() declaration.

hmm.. tcp should never need so_rcvbuf(). the key in diagnosing message loss problems is to find where it actually loses message: * on the client * on the wire * on the receive buffer of the server * on the server while flushing it to the destination so please first locate where the message loss occurs. -- Bazsi