[syslog-ng] linux kernel tuning

[Scheidler, Balázs]

You probably need to restart syslog-ng for a buffer size to take effect,
and you also have to make sure to change the correct knobs.

There are two things to take into consideration.

1) throughput
2) latency

If the throughput is higher than what syslog-ng handles with the specific
config, buffer sizes will not help.

If syslog-ng is generally able to cope with the load, one has to make sure
that the input buffer size of a socket is large enough to keep incoming
traffic between syslog-ng starting the poll on the socket vs it actually
starts reading messages.

Also, syslog-ng may be forced to stop reading it's input if the destination
blocks/slow.

Back to how long it takes for tuning to take effect: after a restart,
immediately if the load is the same.

Bazsi

On Jun 23, 2017 8:58 PM, "Jim Hendrick" <james.r.hendrick at gmail.com> wrote:

> Hi all,
>
>   What are your experiences with tuning the kernel for UDP, TCP, etc.
>
> How long does it take to see results from a single change?
>
> We are working issues with UDP drops, and have made fairly radical
> increases in buffer sizes with no apparent improvement, only to re-visit
> the system in a few days and seeing it cleaned up.
>
> "intuitively" I have always thought it should happen right away - but that
> is not what we are seeing here now.
>
> Thoughts?
>
> Thanks in advance!
>
> Jim
>
>
>
>
> ____________________________________________________________
> __________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?
> product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20170623/6ebec41f/attachment.html>