TCP orig_log_iw_size='3', why?

[email protected] Sat, 01 Mar 2025 08:32:47 +0100
Newsgroups	gmane.comp.syslog-ng
Message-ID	<[email protected]>
--===============0160466334010409682==
Content-Type: multipart/alternative;
 boundary="=_9772b4051926aee9d837d33baee69e08"

--=_9772b4051926aee9d837d33baee69e08
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=US-ASCII

 

Hello syslog-ng community,

 I get this warning at syslog-ng start (or restart) when running
journalctl

 [...]
 Feb 27 02:46:57 xxxsplunksyslog1 syslog-ng[2998304]:
[2025-02-27T02:46:57.330923] WARNING: window sizing for tcp sources were
changed in syslog-ng 3.3, the configuration value was divided by the
value of max-connections(). The result was too small, clamping to value
of min_iw_size_per_reader. Ensure you have a proper log_fifo_size
setting to avoid message loss.; orig_log_iw_size='3',
new_log_iw_size='100', min_iw_size_per_reader='100',
min_log_fifo_size='30000'
 Feb 27 02:46:57 xxxsplunksyslog1 systemd[1]: Started System Logger
Daemon.

 I thought the orig_log_iw_size value was coming from the formula
log_iw_size/max_connections which should be 100/300=1/3
 What is this orig_log_iw_size='3' ?

 Thanks. 
--=_9772b4051926aee9d837d33baee69e08
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset=UTF-8

<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; charset=
=3DUTF-8" /></head><body style=3D'font-size: 10pt; font-family: Verdana,Gen=
eva,sans-serif'>
<p>Hello syslog-ng community,<br /> <br /> I get this warning at syslog-ng =
start (or restart) when running journalctl<br /> <br /> [...]<br /> Feb 27 =
02:46:57 xxxsplunksyslog1 syslog-ng[2998304]: [2025-02-27T02:46:57.330923] =
WARNING: window sizing for tcp sources were changed in syslog-ng 3.3, the c=
onfiguration value was divided by the value of max-connections(). The resul=
t was too small, clamping to value of min_iw_size_per_reader. Ensure you ha=
ve a proper log_fifo_size setting to avoid message loss.; orig_log_iw_size=
=3D'3', new_log_iw_size=3D'100', min_iw_size_per_reader=3D'100', min_log_fi=
fo_size=3D'30000'<br /> Feb 27 02:46:57 xxxsplunksyslog1 systemd[1]: Starte=
d System Logger Daemon.<br /> <br /> I thought the orig_log_iw_size value w=
as coming from the formula log_iw_size/max_connections which should be 100/=
300=3D1/3<br /> What is this orig_log_iw_size=3D'3' ?<br /> <br /> Thanks=
=2E</p>
</body></html>

--=_9772b4051926aee9d837d33baee69e08--


--===============0160466334010409682==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq


--===============0160466334010409682==--