[syslog-ng] Few messages are not getting forwarded to destination

SZIGETVÁRI János jszigetvari at gmail.com
Fri Jul 28 13:31:30 UTC 2017


Dear Harish,

Could you share your whole config with us?

Regarding UDP performance tuning, you may find further useful information
here:
https://www.balabit.com/documents/syslog-ng-pe-6.0-
guides/en/syslog-ng-tutorial-udp-source/html-single/index.html

Another useful infomation is that the net.core.rmem_max kernel parameter
has to be at least the double of so-rcvbuf() setting. See man 7 socket for
further information.
In higher traffic UDP logging scenarios 256 MB for the rmem_max, and 128 MB
for so-rcvbuf() might be useful.

Thank you!

Best regards,
János Szigetvári

-- 
Janos SZIGETVARI
RHCE, License no. 150-053-692
<https://www.redhat.com/rhtapps/verify/?certId=150-053-692>

__ at __˚V˚
Make the switch to open (source) applications, protocols, formats now:
- windows -> Linux, iexplore -> Firefox, msoffice -> LibreOffice
- msn -> jabber protocol (Pidgin, Google Talk)
- mp3 -> ogg, wmv -> ogg, jpg -> png, doc/xls/ppt -> odt/ods/odp

2017-07-28 9:10 GMT+02:00 Harish Shetty <harish23shetty at gmail.com>:

> Hi
>
> I am  using "syslog-ng-3.9.1-1.el6.x86_64" .  Few messages are not getting
> forwarded to destination (Monitoring hosts). But messages are receiving in
> syslog-ng server from the client.
>
> As a tuning parameter I am using
>
> log_fifo_size (20000);
> flush_lines (0);
> time_reopen (10);
>
> For  source s_tcp  , source s_udp  and source s_net
> so_rcvbuf(8388608)
> max-connections(200)
> log-iw-size(20000)
>
> Could you please let me know , how we can avoid the messages are not
> getting forwarded ti destination.
>
> Regards
> Harish Shetty
>
> ____________________________________________________________
> __________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?
> product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20170728/44afb650/attachment.html>


More information about the syslog-ng mailing list