When I have a udp log source defined with a large so_rcvbuf the upd messages are being delayed. It seems that the so_rcvbuf needs to fill before the data is read. Can anyone confirm that the so_rcvbuf needs to fill prior to data being read from the port? Evan.