[syslog-ng] WARNING: window sizing for tcp sources

Gergely Nagy algernon at balabit.hu
Tue Dec 11 12:52:46 CET 2012

Anton Koldaev <koldaevav at gmail.com> writes:

> source s_remote {
>     udp(ip( port(514) so_rcvbuf(1024000)); # Switches are
> configured to send logs here
>     tcp(ip( port(5140) max-connections(250) so_rcvbuf(1024000)
> log_iw_size(20000) so_keepalive(yes) log_fetch_limit(100));
>     syslog(ip( transport("tcp") port(5141) max-connections(200)
> log_iw_size(20000) flags("threaded") log_fetch_limit(100));
> };

The log_iw_size(20000)/max-connections(250) thing is what triggers the
error message, by the looks of it. Increasing log_iw_size to 25000
should make the warning go away.

The warning could use an update, though, that makes it clearer where it
gets the numbers from.


More information about the syslog-ng mailing list