[syslog-ng] UDP packet loss with syslog-ng

[Lars Kellogg-Stedman]

> Me too! :)  Things are better (but still not perfect) with a 2GB

*2MB.

And as long as we're talking about buffers:

> A little.  It wasn't clear from the documentation how so_rcvbuf()
> interacts with the kernel settings (net.core.rmem_default and
> net.core.rmem_max).

It seems like other folks on the list weren't clear on this, either,
so I went ahead and did a little research.

If you take a look in net/core/sock.c in the Linux kernel, you'll see that:

- If you don't explicitly set a receive buffer size via setsockopt(),
the kernel uses the value of the net.core.rmem_default sysctl to set
the size of sk->sk_rcvbuf:

          sk->sk_rcvbuf           =       sysctl_rmem_default;

- Calling setsockopt() with SO_RCVBUF sets sk->sk_rcvbuf.  In most
cases, the actual value of sk->sk_rcvbuf is double what you asked for
when you called SO_RCVBUF:

                if ((val * 2) < SOCK_MIN_RCVBUF)
                        sk->sk_rcvbuf = SOCK_MIN_RCVBUF;
                else
                        sk->sk_rcvbuf = val * 2;
                break;

So it looks as if calling setsockopt() with the same value as
rmem_default will in fact give you roughly twice the buffer space.