Return
-
Title
The syslog ng status indicate that window sizing for tcp sources were changed in syslog ng PE -
Description
The syslog-ng works, but the systemctl status syslog-ng -l command shows the following:WARNING: window sizing for tcp sources were changed in syslog-ng PE 4.1, the configuration value was divided by the value of max-connections(). The result was too small, clamping to 100 entries. Ensure you have a proper log_fifo_size setting to avoid message loss.; orig_log_iw_size='50', new_log_iw_size='100', min_log_fifo_size='50000' -
Cause
Configuration change warning. -
Resolution
This message is only a warning and probably the log_fifo_size, the log_iw_size or the max-connections was changed from the original value.A look on the config should show what was changed or even better a syslog debug archive can help to see the whole picture.The max-connections and log-iw-size was changed from the default values. In the config log_iw_size/max_connections is 50, which is lower than syslog-ng's lowest value limit.This warning is saying due to configuration set the log_iw_size became 50, but the lowest value allowed is 100, so syslog-ng automatically increased it.There is more details on flow control in the online documentation here: Syslog-NG PE Admin Guide