The so-rcvbuf() has a corresponding entry called net.core.rmem_max in /etc/sysctl.confFrom the Linux kernel side the net.core.rmem_max parameter limits the values so-rcvbuf() can take.For RHEL the default net.core.rmem_max value is 262144 bytes and therefore may not be listed in sysctl.conf as it is a default. Other operating systems may have different default values.To increase the net.core.rmem_max value add the following line or modify the existing one in /etc/sysctl.conf.
net.core.rmem_max = <New Value>
The following guidelines should be noted when setting the net.core.rmem_max value.
- net.core.rmem_max should be at least twice as big as so-rcvbuf()
- The largest safe value net.core.rmem_max may take is 2147483647 (2GB-1)
- The largest value so-rcvbuf() may take is 1073741823 (1GB-1)
From the admin guide.
++++++++
Note that on certain platforms, ……. even low message load (~200 messages per second) can result in message loss, unless the so-rcvbuf() option of the source is increased. In such cases, you will need to increase the net.core.rmem_max parameter of the host (for example, to 1024000), but do not modify net.core.rmem_default parameter.
++++++++
For details on how to performance tune UDP log reception please see the following KB article.https://support.oneidentity.com/kb/4283052/how-to-performance-tune-udp-log-reception-of-syslog-ng-udp-packets-are-getting-dropped-receiving-packet-receive-and-buffer-errors-4283052