[syslog-ng] Message loss (probably) within syslog-ng

[Mike]

> | >Hi,
> | >
> | >I get a kind of message loss trouble like in some previous message with the subject "remote logging not reliable", but in his case, the remote
> | >logging was done other tcp and this was pointed as the probable cause of message loss. In my case only udp is involved.
> | >
> |
> | is your OS dropping packets before syslog-ng gets a chance to grab them?
>
> Definitely no or at least not in any visible way:
> - no drop in netstat -s for either UDP nort IPv4
> - if I snoop at the same time on the receiving interface, I get the
>  right number of packets.
>
> | if you see some, then you can increase your UDP buffer size to help smooth this out in the case of bursts.
>
> I'd love to do that anyway but in fact this is only doable by a setsockopt
> syscall (SO_RCVBUF) and there's not option in the config file to do it.
> I'll try to do it but I'm not sure the cause is here.
>
> Vincent.


Heya,

this tells you how to adjust the buffer size system wide. 
http://www.29west.com/docs/THPM/udp-buffer-sizing.html

but if netstat -su is not showing packet loss, then adjusting this value 
probably won't help you. but it may be worth a shot..

Mike