[syslog-ng] udp tuning - where to look.

[Jim Hendrick]

Hi,

  I am working an issue with UDP drops in a high EPS rate environment
(several thousand steady) and struggling with making any changes in the
loss rate. (according to netstat -su | grep error).

  This is happening on two nodes, (one running an older syslog-ng 3.2 OSE,
the other running a splunk forwarder) but I don't actually think it is
making it out of the kernel to either application.

  On the syslog-ng side syslog-ng-ctl stats shows *no* drops at all.

  Increasing net.core.rmem_max and so_rcvbuf together all the way to 64 MB
did not seem to make any significant difference.

  This is a RHEL 6 box with 16 GB and 4 cores (virtual - running in an ESX
environment)

  Are there other parameters, things I should be looking at?

Thanks,

Jim
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20170110/05ce430c/attachment.html>