[syslog-ng]syslog-ng vs (of all things) Win2k + IIS

[Balazs Scheidler]

On Tue, Oct 10, 2000 at 01:43:56PM -0500, matthew.copeland@honeywell.com wrote:
> > The worst case is the following scenario:
> > 1) the destination fd is the first to be polled, so there's nothing waiting
> > to be written.
> > 2) each source fd is after the destination fd, and each has some data
> > available
> > 3) the destination will not be flushed until the next iteration
> > 
> > You only have to make sure that the destination fifo doesn't overflow in a
> > single poll loop. If you assume that a 2048 byte block may contain 20
> > messages, and you have 10 sources, you'll have to increase the fifo size to
> > at least 10*20=200 entries.
> 
> What are the implications of changing max_connections to 300 in afinet.c
> in the routine make_afinet_source?  I am wanting this to be able to be
> used by 300 (or maybe a little more) computers for remote logging.  

Worst case is that each of your 300 source connections has data in it,
maximum 20 messages, so you should increase your log_fifo_size to 
6000. the memory usage of this should be around 6000*200*1.5 (with 200 bytes
average log message and 50% overhead) that's 2megs of memory per
destination.

> I also need to make it so that if it loses a connection it will queue the
> information until it reconnects probably upto some bound.  If I change the
> fifo length upto something much larger, is it going to cause a problem?

It's the client where you should increase the fifo value to the number of
messages you wish to keep buffered. 10000 fifo entries should be enough for
10000 seconds = 166 minutes ~ 2.5 hours, assuming you have a single log
message per second. This may use about 3MB memory.

-- 
Bazsi
PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1
     url: http://www.balabit.hu/pgpkey.txt