Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,8 @@ For UDP-based sources, the window size is not divided by `max-connections()`, be

In addition to the static control window set using the `log-iw-size()` option, you can also allocate a dynamic window to the source. The AxoSyslog application uses this window to dynamically increase the static window of the active connections. The dynamic window is distributed evenly among the active connections of the source. The AxoSyslog application periodically checks which connections of the source are active, and redistributes the dynamic window. If only one of the connections is active, it receives the entire dynamic window, while other connections receive only their share of the static window.

{{< include-headless "wnt/warning-log-iw-size-restart.md" >}}

Using dynamic flow-control on your AxoSyslog server is useful when the source has lots of connections, but only a small subset of the active clients send messages at high rate, and the memory of the AxoSyslog server is limited. In other cases, it is currently not recommended, because it can result in higher memory usage and fluctuating performance compared to using only the static window.

When flow-control is used, every source has its own control window. As a worst-case situation, memory of the host must be greater than the total size of the messages of every control window, plus the size of the dynamic window, that is, the `log-iw-size()`+`dynamic-window-size()`. This applies to every source that sends logs to the particular destination. Thus if two sources having several connections and heavy traffic send logs to the same destination, the control window of both sources must fit into the memory of the host. Otherwise, some messages might not fit in the memory, and messages may be lost.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@ If you modify the `max-connections()` or the `log-fetch-limit()` parameter, do n

{{% /alert %}}

{{< include-headless "wnt/warning-log-iw-size-restart.md" >}}

## Example: Sizing parameters for flow-control

Expand Down
1 change: 1 addition & 0 deletions content/headless/chunk/option-source-file-log-iw-size.md
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@

*Description:* The size of the initial window, this value is used during flow control. Make sure that `log-iw-size()` is larger than the value of `log-fetch-limit()`.

{{< include-headless "wnt/warning-log-iw-size-restart.md" >}}
1 change: 1 addition & 0 deletions content/headless/chunk/option-source-log-iw-size.md
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@

*Description:* The size of the initial window, this value is used during flow-control. Its value cannot be lower than 100, unless the `dynamic-window-size()` option is enabled. For details on flow-control, see {{% xref "/chapter-routing-filters/concepts-flow-control/_index.md" %}}.

{{< include-headless "wnt/warning-log-iw-size-restart.md" >}}
2 changes: 1 addition & 1 deletion content/headless/chunk/source-syslog-options.md
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ The `syslog` source uses multiple threads only if the source uses the `tls` or `

{{% include-headless "chunk/option-source-log-iw-size.md" %}}

If the `max-connections()` option is set, the `log-iw-size()` will be divided by the number of connections, otherwise `log-iw-size()` is divided by 10 (the default value of the `max-connections()` option). The resulting number is the initial window size of each connection. For optimal performance when receiving messages from {{% param "product.abbrev" %}} clients, make sure that the window size is larger than the `flush-lines()` option set in the destination of your clients.
If the `max-connections()` option is set, the `log-iw-size()` will be divided by the number of connections (except for UDP-based connection), otherwise `log-iw-size()` is divided by 10 (the default value of the `max-connections()` option). The resulting number is the initial window size of each connection. For optimal performance when receiving messages from {{% param "product.abbrev" %}} clients, make sure that the window size is larger than the `flush-lines()` option set in the destination of your clients.


### Example: Initial window size of a connection
Expand Down
9 changes: 9 additions & 0 deletions content/headless/wnt/warning-log-iw-size-restart.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
---
---
<!-- This file is under the copyright of Axoflow, and licensed under Apache License 2.0, except for using the Axoflow and AxoSyslog trademarks. -->

{{% alert title="Warning" color="warning" %}}

Changing the value of `log-iw-size()` takes effect only after the [`syslog-ng` service is restarted]({{< relref "/quickstart/managing-and-checking-linux/_index.md#restart-axosyslog" >}}). A simple configuration reload is _NOT_ sufficient.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's not true.

The window size of already active connections won't change, everything else works perfectly.
If you set keep-alive(no), no connections will be kept alive during reload, so the window size will propagate through the whole system.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what about udp?

Copy link
Member

@MrAnno MrAnno Oct 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's considered a single connection, if keep-alive(yes) is set, it needs a restart, otherwise everything is fine.


{{% /alert %}}