[syslog-ng] UDP packet loss with syslog-ng

[Matthew Hall]

On Fri, Oct 15, 2010 at 05:11:21PM -0400, Lars Kellogg-Stedman wrote:
> > Actually, you did not say it in your message. Because searching it for
> > the string 'buf' returns no results.
> 
> Look, I'm not trying to be difficult, but I do at least expect people
> to read my email before responding.  Here, I'll quote it for you:

I was reading your email but I'm not seeing much reason to continue if 
this is the kind of things it will contain. I'm sorry your setup is 
having problems and I'm sure you are frustrated about it but that 
doesn't necessitate flames.

None of these options you tried were 100% the same as the set we have 
suggested adjusting. So my point still stands that we did read your mail 
and suggest new ideas.

> I'm sorry if you got bored before reading it.  I was trying to provide
> sufficient details that people wouldn't suggest the things I've
> already tried.

I did read the entire thing before replying as I do with every mail I've 
received in my long career.

> Additionally, as far as I can tell, setting net.core.rmem_default is
> largely equivalent, from the point of view of syslog-ng, to setting
> so_rcvbuf() (since it sets the default receive buffer size).  On a
> system with lots of open sockets, setting a lower
> net.core.rmem_default and using so_rcvbuf() would probably make more
> sense.

Could be. But unless you are willing to invest the time to read the libc 
sources and the kernel sources and man 7 socket and other documentation 
to confirm, it's worth trying the setting to see if it helps since it's 
helped me with these sorts of issues in the past.

Matthew.