im_udp SockBufSize option | Log collection solutions

#1 Savane 6 years ago

I though it would change something but I found that with or without SockBufSize, my message size limit is ~64K.

I was not able to find confirmation but I suppose this is the max and can't be changed even with SockBufSize. Is it right? (for the tests I set SockBufSize to 150000000 as it is suggested in the documentation)

Module im_udp Host localhost Port 514 SockBufSize 150000000 # tested with and without this line

I found this interesting post https://nxlog.co/question/2757/execasync-cant-run-powershell-script and will probably apply this solution but I wanted to know if I could increased the size anyway.

Thank you.

Permalink

#2 b0ti Nxlog ✓ 6 years ago

#1 Savane

Hello, I was testing the SockBufSize option in im_udp because I got the following error and had to reboot the service: "Module inUDP couldn't read from socket; A message sent on a datagram socket was larger than the internal message buffer or some other network limit, or the buffer used to receive a datagram into was smaller than the datagram itself." I though it would change something but I found that with or without SockBufSize, my message size limit is ~64K. I was not able to find confirmation but I suppose this is the max and can't be changed even with SockBufSize. Is it right? (for the tests I set SockBufSize to 150000000 as it is suggested in the documentation) Module im_udp Host localhost Port 514 SockBufSize 150000000 # tested with and without this line I found this interesting post https://nxlog.co/question/2757/execasync-cant-run-powershell-script and will probably apply this solution but I wanted to know if I could increased the size anyway. Thank you.

SockBufSize is for the socket buffer and specifying this explicitly should help with the issue in theory. I think the default value is set by the OS.

Note that the standard UDP packet size is limited to 64k. See the wikipedia page on UDP for example. Even if you manage to generate larger UDP datagrams, these might get discarded elsewhere on the network by routers due to the above reason. Also note that as per RFC3164 the The total length of the packet MUST be 1024 bytes or less.