[syslog-ng] udp tuning - where to look.

[Fabien Wernli]

Hi Jim,

On Tue, Jan 10, 2017 at 04:20:02PM -0500, Jim Hendrick wrote:
> loss rate. (according to netstat -su | grep error).
[…]
>   On the syslog-ng side syslog-ng-ctl stats shows *no* drops at all.

This means that syslog-ng isn't accepting the packets fast enough, so the
kernel starts buffering, and the latter gets full, thus increasing the
kernel counters (see `/proc/net/snmp`).

>   Increasing net.core.rmem_max and so_rcvbuf together all the way to 64 MB
> did not seem to make any significant difference.

I'm afraid these are the values I was going to suggest.

>   This is a RHEL 6 box with 16 GB and 4 cores (virtual - running in an ESX
> environment)

FWIW I've had many problems with dropped Udp on virtual machines. It's easy
to correlate the `steal` cpu state with drop events where relevant.

>   Are there other parameters, things I should be looking at?

I'm curious too if there is anything else that can be done (apart from
switching to TCP).