[syslog-ng] Configuration tuning for reliability

[Matthew Hall]

On Thursday, November 11, 2010 08:29:32 Martin Holste wrote:
> You should not be having problems with your load.  We had a thread
> earlier this year ("UDP packet loss with syslog-ng") in which Lars
> identified similar performance issues on RHEL.  His problems were
> solved by setting the net.core.rmem_default to 2MB using sysctl.  I
> would try setting that and then checking your performance.

Make sure to also set the so_rcvbuf in syslog-ng on any high volume socket 
based log sources.

You need to have a really big buffer or you will get terrible performance. 
We've been making some efforts to get this into the documentation.

I think it's small by default so it doesn't consume a ton of RAM on boxes 
that are not used for log collection.
-- 
Matthew Hall