[syslog-ng] udp packet receive errors

[Balazs Scheidler]

On Fri, 2009-12-11 at 18:32 +0530, Paras Fadte wrote:
> Hi,
> 
> When logging to a remote syslog server , I see a lot of udp "packet
> receive errors" on the remote syslog server . The source machines
> don't show any such packet loss.  I tried increasing
> net.core.wmem_max to 16MB and changed the log_fifo_size value to 2000
> from default 100 on remote syslog server but still I continue to see
> udp packet receive errors . What could be the issue here ? The
> incoming request rate is  inorder of  50k/sec during peak time. What
> can be done to minimize these errors? 
> 
> Syslog-ng version is syslog-ng 1.6.8
> 

you should increase the _receive_ buffer size of the server, not tune
the client.

you can generally tune this stuff via /proc/sys/net and recent
syslog-ng's even have some syslog-ng.conf knobs to do the same.

just look for so_rcvbuf() options, but please note that kernels may
limit this value even if the application requests larger sizes.

See "man 7 socket", and search for /proc/sys/net/core/rmem_default
and /proc/sys/net/core/rmem_max

-- 
Bazsi