[syslog-ng]How to lessen/fix dropped messages?

[Balazs Scheidler]

On Wed, 2003-12-10 at 17:54, Josh Endries wrote:
> Hey all,
> 
> We log 20ish hosts to a central log server (many are through stunnel) 
> and recently I started getting dropped messages. I see anywhere from 
> 1-10 dropped per STATS line. This probably has something to do with us 
> installing iplog on some machines and increasing the traffic (only 
> timely coincidence I can think of) I'm wondering what, if anything, can 
> be done to help the situation.
> 
> I've read that you can increase the log_fifo_size to help with this 
> problem, but I'm not sure what the default value is or what I should set 
> it to. Is there a guideline for what to set this for X number of 
> machines, or for a certain amount of traffic?

log_fifo_size specifies the number of log lines a given destination can
temporarily hold before starting to drop messages. The default value is
100 and you could increase this number at will. Please note however that
syslog-ng will not enforce flow control, that is it will not limit
incoming message rate if it is not able to send messages at the smae
speed. If you only have a couple of bursts but the overall message rate
stays below the processing limits of your central server then
log_fifo_size will help. Otherwise you will have to increase
server/network capacities.

-- 
Bazsi