[syslog-ng] Message loss (probably) within syslog-ng

[Vincent Haverlant]

Le Mon Mar  6 06:59:01 2006, Mike a écrit:
| Heya,
| 
| this tells you how to adjust the buffer size system wide. http://www.29west.com/docs/THPM/udp-buffer-sizing.html
| 
| but if netstat -su is not showing packet loss, then adjusting this value probably won't help you. but it may be worth a shot..
| 
| Mike

Hi,

This is a very good and interesting link for the generic tuning of the
network stack. However what is says is how to set the udp max buffer
size:
# ndd /dev/udp udp_max_buf
1048576
which according to
http://docs.sun.com/app/docs/doc/806-6779/6jfmsfr8b?a=view sets the
"maximum allowed buffer size for an udp socket", not the actual value.

The default receive buffer size is set using the parameter
udp_recv_hiwat which is currently set to its maximum value of 65536. To
increase it the only way is the setsockopt syscall.

Anyway I don't get that many udpInOverflows (a few everyday) but it does
not explain the few thousand messages I miss in my logs files.

Regards,
Vincent.
-- 
   .~.     Vincent Haverlant  -- Galadril -- #ICQ: 35695155   
   /V\      MSN: vincent_msn at haverlant.org  -- http://www.haverlant.org/
  /( )\      Parinux member: http://www.parinux.org/
  ^^-^^       GPG: 8FEA 52C2 5C54 A201 2375  0FA5 AF2E 1881 92D0 EE84