MonitorWare Knowledge Base

while sending a bulk of messages from a remote host to syslog server a few messages are dropped.
Why does this happens? and can I eliminate it?

• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

Sounds like the nature of UDP. Use TCP instead.

After checking this issue, it is related to the receive buffer of the UDP socket, after increase the buffer size, indeed the number of drops decreased.
but I think that there is an elegant way to solve it, read the message from the socket buffer immediatliy and write it to a queue and in different thread read from the queue and parse the message, this way the socket buffer will not be filled out of space.

have you compiled with multi-threading?

yes, my MakeFile has FEATURE_PTHREADS=1

ok, let me check...