syslog-ng-users July 2011 archive
Main Archive Page > Month Archives  > syslog-ng-users archives
syslog-ng-users: Re: [syslog-ng] max-connections(1000)

Re: [syslog-ng] max-connections(1000)

From: Gergely Nagy <algernon_at_nospam>
Date: Fri Jul 15 2011 - 11:46:30 GMT
To: Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu>

Josu Lazkano <josu.lazkano@barcelonamedia.org> writes:

> Hello list, this morning I had some problems with my syslog system I am adding lots of server to send TCP logs to the syslog-ng server. But there are not on the server.
>
> After readingon the web, I notice that there is a max-connections parameter on the TCP. So I fix to 50. With this there are more logs, then I added 100 and there more.
>
> So I fix it to 1000:
>
> source s_all {
> internal();
> unix-stream("/dev/log");
> file("/proc/kmsg" log_prefix("kernel: "));
> tcp(max-connections(1000));
> };
>
> Is this a good idea?
>
> How can I check if this is a good maximum connection value?

The kernel-imposed limit is that each connection and each destination is
a separate file descriptor, and the number of open file descriptors /
process is usually limited.

On most Linux systems, that is 1024. The total number of open files and
TCP connections therefore is limited to 1024.

However, this limit can also be raised, using ulimit (and perhaps poking
into various configuration files, such as /etc/security/limits.conf).

-- |8] ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq