balazs.scheidler at balabit.com
Fri Nov 20 06:45:55 CET 2015
You dont need to bother with log-fetch-limit() as that parameter is there
to avoid starvation if a connection is continuously sending messages
without a pause. This is needed as a single thread handles multiple
connections and if one sends messages continuously the rest wouldnt get a
If all input connections send a single message then I wouldnt bother with
so-rcvbuf either. And not with TCP anyway.
You might want to increase max-connections though to accept potential peaks.
Sending one message per TCP connection is not really ideal performance wise
though, 250 msg/sec is not much if connections are kept alive. Isn't
running syslog-ng or something else on the client feasible? One that would
keep the connection for longer term?
On Nov 20, 2015 4:48 AM, "Al Itchon" <AItchon at boardreader.com> wrote:
> I have about 1000 servers sending tcp messages through a call to /dev/tcp
> to a port on my syslog-ng server. I’m assuming each call to /dev/tcp is a
> single connection and a single message, so am I correct that the
> log_fetch_limit should be set to 1 since it applies to each connection?
> Also, should I bother adjusting the so-rcvbuf? I know the manual mentions
> that if using UDP, the receive buffer should be increased. I’m using TCP
> and my message rate is about 250 messages/sec.
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the syslog-ng