[syslog-ng] Message loss (probably) within syslog-ng

Mike mike at jeke.fdns.net
Mon Mar 6 12:59:01 CET 2006

> | >Hi,
> | >
> | >I get a kind of message loss trouble like in some previous message with the subject "remote logging not reliable", but in his case, the remote
> | >logging was done other tcp and this was pointed as the probable cause of message loss. In my case only udp is involved.
> | >
> |
> | is your OS dropping packets before syslog-ng gets a chance to grab them?
> Definitely no or at least not in any visible way:
> - no drop in netstat -s for either UDP nort IPv4
> - if I snoop at the same time on the receiving interface, I get the
>  right number of packets.
> | if you see some, then you can increase your UDP buffer size to help smooth this out in the case of bursts.
> I'd love to do that anyway but in fact this is only doable by a setsockopt
> syscall (SO_RCVBUF) and there's not option in the config file to do it.
> I'll try to do it but I'm not sure the cause is here.
> Vincent.


this tells you how to adjust the buffer size system wide. 

but if netstat -su is not showing packet loss, then adjusting this value 
probably won't help you. but it may be worth a shot..


More information about the syslog-ng mailing list