[syslog-ng] Configuration tuning for reliability

[Matthew Hall]

On Thursday, November 11, 2010 08:51:11 Matthew Hall wrote:
> On Thursday, November 11, 2010 08:29:32 Martin Holste wrote:
> > You should not be having problems with your load.  We had a thread
> > earlier this year ("UDP packet loss with syslog-ng") in which Lars
> > identified similar performance issues on RHEL.  His problems were
> > solved by setting the net.core.rmem_default to 2MB using sysctl.  I
> > would try setting that and then checking your performance.
> 
> Make sure to also set the so_rcvbuf in syslog-ng on any high volume
> socket based log sources.
> 
> You need to have a really big buffer or you will get terrible
> performance. We've been making some efforts to get this into the
> documentation.
> 
> I think it's small by default so it doesn't consume a ton of RAM on boxes
> that are not used for log collection.

By really big I mean 16,777,216.
-- 
Matthew Hall