Re: TCP orig_log_iw_size='3', why?
[email protected] Sat, 01 Mar 2025 10:20:23 +0100
| Newsgroups | gmane.comp.syslog-ng |
|---|---|
| Message-ID | <[email protected]> |
--===============2804385611304157443==
Content-Type: multipart/alternative;
boundary="=_b9702fb009598e126f589fa50039a1dd"
--=_b9702fb009598e126f589fa50039a1dd
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=US-ASCII
Let me add some background:
# cat /etc/redhat-release
Red Hat Enterprise Linux release 9.4 (Plow)
# syslog-ng --version
syslog-ng 3 (3.35.1)
Config version: 3.35
Installer-Version: 3.35.1
Revision:
Compile-Date: Feb 6 2023 00:00:00
Module-Directory: /usr/lib64/syslog-ng
Module-Path: /usr/lib64/syslog-ng
Include-Path: /usr/share/syslog-ng/include
Available-Modules:
xml,add-contextual-data,affile,afprog,afsocket,afstomp,afuser,appmodel,azure-auth-header,basicfuncs,cef,confgen,cryptofuncs,csvparser,dbparser,disk-buffer,examples,graphite,hook-commands,json-plugin,kvformat,linux-kmsg-format,map-value-pairs,pseudofile,regexp-parser,sdjournal,secure-logging,stardate,syslogformat,system-source,tags-parser,tfgetent,timestamp
Enable-Debug: off
Enable-GProf: off
Enable-Memtrace: off
Enable-IPv6: on
Enable-Spoof-Source: on
Enable-TCP-Wrapper: off
Enable-Linux-Caps: on
Enable-Systemd: on
Extracts from /etc/syslog-ng/syslog-ng.conf:
#### START OF SYSLOG-NG.CONF CONFIGURATION FILE ####
@version:3.5
@include "scl.conf"
options {
flush_lines (100);
time_reopen (10);
log_fifo_size (30000); # Default is 1000
chain_hostnames (off);
use_dns (yes); # This enables IP to hostname translation; this has no
effect if keep_hostname() is enabled and message contains a hostname
dns_cache(yes); # DNS caching to improve hostname translation
dns-cache-size(2000); # Default is 1007
dns-cache-expire(14400); # Default is 3600
use_fqdn (yes); # This has no effect if keep_hostname() is enabled and
message contains a hostname
create_dirs (yes);
keep_hostname (yes);
threaded (yes);
};
source s_nas {
network(ip(X.X.X.X) transport(tcp) port(514));
network(ip(X.X.X.X) transport(udp) port(514) so-rcvbuf(26214400));
tcp(ip(X.X.X.X) port(44514) max-connections(300) tls(
key_file("/etc/syslog-ng/key.d/priv.key")
cert_file("/etc/syslog-ng/cert.d/cert.pem")
peer_verify(optional-untrusted))
);
destination d_nas {
file("/opt/$LOGHOST/logs/nas/$R_YEAR-$R_MONTH-$R_DAY/$HOST/$YEAR$MONTH$DAY.log"
template(t_splunk)
dir-owner("splunk") dir-group("splunk") dir-perm(0750)
owner("splunk") group("splunk") perm(0640));
};
log { source(s_nas); destination(d_nas); flags(flow-control);};
Thanks.
Il 2025-03-01 08:32 [email protected] ha scritto:
> Hello syslog-ng community,
>
> I get this warning at syslog-ng start (or restart) when running journalctl
>
> [...]
> Feb 27 02:46:57 xxxsplunksyslog1 syslog-ng[2998304]: [2025-02-27T02:46:57.330923] WARNING: window sizing for tcp sources were changed in syslog-ng 3.3, the configuration value was divided by the value of max-connections(). The result was too small, clamping to value of min_iw_size_per_reader. Ensure you have a proper log_fifo_size setting to avoid message loss.; orig_log_iw_size='3', new_log_iw_size='100', min_iw_size_per_reader='100', min_log_fifo_size='30000'
> Feb 27 02:46:57 xxxsplunksyslog1 systemd[1]: Started System Logger Daemon.
>
> I thought the orig_log_iw_size value was coming from the formula log_iw_size/max_connections which should be 100/300=1/3
> What is this orig_log_iw_size='3' ?
>
> Thanks.
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng [1]
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng [2]
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq [3]
Links:
------
[1] https://lists.balabit.hu/mailman/listinfo/syslog-ng
[2] http://www.balabit.com/support/documentation/?product=syslog-ng
[3] http://www.balabit.com/wiki/syslog-ng-faq
--=_b9702fb009598e126f589fa50039a1dd
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset=UTF-8
<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; charset=
=3DUTF-8" /></head><body style=3D'font-size: 10pt; font-family: Verdana,Gen=
eva,sans-serif'>
<p>Let me add some background:</p>
<div> </div>
<div># cat /etc/redhat-release</div>
<p>Red Hat Enterprise Linux release 9.4 (Plow)</p>
<div> </div>
<div># syslog-ng --version</div>
<div>syslog-ng 3 (3.35.1)<br />Config version: 3.35<br />Installer-Version:=
3.35.1<br />Revision:<br />Compile-Date: Feb 6 2023 00:00:00<br />Mo=
dule-Directory: /usr/lib64/syslog-ng<br />Module-Path: /usr/lib64/syslog-ng=
<br />Include-Path: /usr/share/syslog-ng/include<br />Available-Modules: xm=
l,add-contextual-data,<wbr />affile,afprog,afsocket,<wbr />afstomp,afuser,a=
ppmodel,azure-<wbr />auth-header,basicfuncs,cef,<wbr />confgen,cryptofuncs,=
csvparser,<wbr />dbparser,disk-buffer,examples,<wbr />graphite,hook-command=
s,json-<wbr />plugin,kvformat,linux-kmsg-<wbr />format,map-value-pairs,<wbr=
/>pseudofile,regexp-parser,<wbr />sdjournal,secure-logging,<wbr />stardate=
,syslogformat,system-<wbr />source,tags-parser,tfgetent,<wbr />timestamp<br=
/>Enable-Debug: off<br />Enable-GProf: off<br />Enable-Memtrace: off<br />=
Enable-IPv6: on<br />Enable-Spoof-Source: on<br />Enable-TCP-Wrapper: off<b=
r />Enable-Linux-Caps: on<br />Enable-Systemd: on</div>
<div> </div>
<div>Extracts from /etc/syslog-ng/syslog-<wbr />ng.conf:</div>
<div> </div>
<div>#### START OF SYSLOG-NG.CONF CONFIGURATION FILE ####<br />@version:3=
=2E5<br />@include "scl.conf"<br />options {<br /> flush_lines (100);=
<br /> time_reopen (10);<br /> log_fifo_size (30000); # Default=
is 1000<br /> chain_hostnames (off);<br /> use_dns (yes); # Th=
is enables IP to hostname translation; this has no effect if keep_hostname(=
) is enabled and message contains a hostname<br /> dns_cache(yes); # =
DNS caching to improve hostname translation<br /> dns-cache-size(2000=
); # Default is 1007<br /> dns-cache-expire(14400); # Default is 3600=
<br /> use_fqdn (yes); # This has no effect if keep_hostname() is ena=
bled and message contains a hostname<br /> create_dirs (yes);<br />&n=
bsp; keep_hostname (yes);<br /> threaded (yes);<br />};<br />source s=
_nas {<br /> network(ip(X.X.X.X) transport(tcp) port(514));<br />&nbs=
p; network(ip(X.X.X.X) transport(udp) port(514) so-rcvbuf(26214400));<br />=
tcp(ip(X.X.X.X) port(44514) max-connections(300) tls(<br /> &n=
bsp; key_file("/etc/syslog-ng/key.<wbr />d/priv.key")<br /> ce=
rt_file("/etc/syslog-ng/<wbr />cert.d/cert.pem")<br /> peer_ve=
rify(optional-<wbr />untrusted))<br /> );</div>
<div> </div>
<div>destination d_nas {<br /> file("/opt/$LOGHOST/logs/nas/$<wbr />R=
_YEAR-$R_MONTH-$R_DAY/$HOST/$<wbr />YEAR$MONTH$DAY.log"<br /> templat=
e(t_splunk)<br /> dir-owner("splunk") dir-group("splunk") dir-perm(07=
50)<br /> owner("splunk") group("splunk") perm(0640));<br />};</div>
<div> </div>
<div>log { source(s_nas); destination(d_nas); flags(flow-control);};</div>
<div> </div>
<div>Thanks. </div>
<div> </div>
<p> </p>
<p>Il 2025-03-01 08:32 [email protected] ha scritto:</p>
<blockquote type=3D"cite" style=3D"padding: 0 0.4em; border-left: #1010ff 2=
px solid; margin: 0"><!-- html ignored --><!-- head ignored --><!-- meta ig=
nored -->
<p>Hello syslog-ng community,<br /><br /> I get this warning at syslog-ng s=
tart (or restart) when running journalctl<br /><br /> [...]<br /> Feb 27 02=
:46:57 xxxsplunksyslog1 syslog-ng[2998304]: [2025-02-27T02:46:57.330923] WA=
RNING: window sizing for tcp sources were changed in syslog-ng 3.3, the con=
figuration value was divided by the value of max-connections(). The result =
was too small, clamping to value of min_iw_size_per_reader. Ensure you have=
a proper log_fifo_size setting to avoid message loss.; orig_log_iw_size=3D=
'3', new_log_iw_size=3D'100', min_iw_size_per_reader=3D'100', min_log_fifo_=
size=3D'30000'<br /> Feb 27 02:46:57 xxxsplunksyslog1 systemd[1]: Started S=
ystem Logger Daemon.<br /><br /> I thought the orig_log_iw_size value was c=
oming from the formula log_iw_size/max_connections which should be 100/300=
=3D1/3<br /> What is this orig_log_iw_size=3D'3' ?<br /><br /> Thanks.</p>
<!-- html ignored --><br />
<div class=3D"pre" style=3D"margin: 0; padding: 0; font-family: monospace">=
___________________________________________________________________________=
___<br /> Member info: <a href=3D"https://lists.balabit.hu/mailman/listinfo=
/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br /> D=
ocumentation: <a href=3D"http://www.balabit.com/support/documentation/?prod=
uct=3Dsyslog-ng">http://www.balabit.com/support/documentation/?product=3Dsy=
slog-ng</a><br /> FAQ: <a href=3D"http://www.balabit.com/wiki/syslog-ng-faq=
">http://www.balabit.com/wiki/syslog-ng-faq</a><br /><br /></div>
</blockquote>
</body></html>
--=_b9702fb009598e126f589fa50039a1dd--
--===============2804385611304157443==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq
--===============2804385611304157443==--