[syslog-ng] 3.3.6 - udp sources and delayed log receipt

[Evan Rempel]

Any suggestions on how I debug this?

I have a tcp and a udp source (defined as separate sources) that share a common
destination

log { souce(s_udp); source(s_tcp); destination(d_file); };

90% of the log volume comes from the tcp sources.
The udp log lines are logged 10 minutes "late". If I decrease the so_rcvbuf
then I can get this down to 5-10 seconds "late." I can issue on a source
udp server

logger -t test "this is a test"

and wait on the server. It shows up, but minutes later.

OK, playing a little more, if I add the log_iw_size option on the
udp source, the symptoms go away. Odd since I do NOT have any flow control
in any destination.

Can anyone explain why that option would make a difference?

Evan.


Balazs Scheidler wrote:
> that shouldn't be the case, I've never seen anything like this.
> 
> 
> ----- Original message -----
>  >
>  > When I have a udp log source defined with a large so_rcvbuf the upd
>  > messages are being delayed.
>  >
>  > It seems that the so_rcvbuf needs to fill before the data is read.
>  >
>  > Can anyone confirm that the so_rcvbuf needs to fill prior to data being
>  > read from the port?
>  >
>  > Evan.
>  > 
> ______________________________________________________________________________