[syslog-ng] max-connections(1000)

[Gergely Nagy]

Josu Lazkano <josu.lazkano at barcelonamedia.org> writes:

> Hello list, this morning I had some problems with my syslog system I am adding lots of server to send TCP logs to the syslog-ng server. But there are not on the server.
>
> After readingon the web, I notice that there is a max-connections parameter on the TCP. So I fix to 50. With this there are more logs, then I added 100 and there more.
>
> So I fix it to 1000:
>
> source s_all {
>         internal();
>         unix-stream("/dev/log");
>         file("/proc/kmsg" log_prefix("kernel: "));
>         tcp(max-connections(1000));
> };
>
> Is this a good idea?
>
> How can I check if this is a good maximum connection value?

The kernel-imposed limit is that each connection and each destination is
a separate file descriptor, and the number of open file descriptors /
process is usually limited.

On most Linux systems, that is 1024. The total number of open files and
TCP connections therefore is limited to 1024.

However, this limit can also be raised, using ulimit (and perhaps poking
into various configuration files, such as /etc/security/limits.conf).

-- 
|8]