[syslog-ng] log_fetch_limit

[Scheidler, Balázs]

Hi,

You dont need to bother with log-fetch-limit() as that parameter is there
to avoid starvation if a connection is continuously sending messages
without a pause. This is needed as a single thread handles multiple
connections and if one sends messages continuously the rest wouldnt get a
chance.

If all input connections send a single message then I wouldnt bother with
so-rcvbuf either. And not with TCP anyway.

You might want to increase max-connections though to accept potential peaks.

Sending one message per TCP connection is not really ideal performance wise
though, 250 msg/sec is not much if connections are kept alive. Isn't
running syslog-ng or something else on the client feasible? One that would
keep the connection for longer term?
On Nov 20, 2015 4:48 AM, "Al Itchon" <AItchon at boardreader.com> wrote:

> I have about 1000 servers sending tcp messages through a call to /dev/tcp
> to a port on my syslog-ng server.  I’m assuming each call to /dev/tcp is a
> single connection and a single message, so am I correct that the
> log_fetch_limit should be set to 1 since it applies to each connection?
>
>
>
> Also, should I bother adjusting the so-rcvbuf?  I know the manual mentions
> that if using UDP, the receive buffer should be increased.  I’m using TCP
> and my message rate is about 250 messages/sec.
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20151120/dba76405/attachment.htm